I'm trying to set up a way for users to connect to the same gateway server for SSH/SFTP (SFTP a priority, SSH nice to have) and have that gateway server route the users to private servers inside my network identified by username and the private host they want to reach. This has to be a seamless user experience, i.e - no special config file setup, no flags for command line sessions, and no special setting in UI tools like Filezilla.

What I managed to do so far is add this block to my sshd_config file in the gateway server:

Match User someuser                                                                                                                                                                                                                               
   ForceCommand sftp  -i /home/someuser/.ssh/id_rsa someuser@some_other_server

Now this works great when I'm doing this from a client machine:

ssh -i id_rsa someuser@gateway_server_machine

it will trigger the ForceCommand and give me an SFTP session to the some_other_server machine.


When I do sftp -i id_rsa someuser@gateway_server_machine

the connection hangs and eventually terminated.

so, the sftp doesn't give anything even with verbose - just hangs there - but this is what I get from the server side:

debug1: subsystem: internal-sftp
Starting session: forced-command (config) 'sftp  -i /home/someuser/.ssh/id_rsa someuser@some_other_server ' for someuser from port 58822 id 0

on SSH I get:

Starting session: forced-command (config) 'sftp  -i /home/someuser/.ssh/id_rsa someuser@some_other_server ' on pts/1 for someuser from port 33550 id 0
debug1: Setting controlling tty using TIOCSCTTY.

I need to figure out what am I doing wrong here, or if there is a better way to provide this kind of connection to my users.

ForceCommand sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server

The above will start SFTP client on the intermediate server with its textual interface. Your local SFTP client (sftp or any other) cannot talk to that. It needs binary SFTP protocol. That also explain why ssh seeming works as sftp client. But it does not. It just pipes the textual interface of the sftp client on the intermediate server.

What you need is something like:

ForceCommand ssh -s sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server

That makes the (most) remote server start SFTP server (-s sftp) and the intermediate server to pipe the binary SFTP protocol to and back (ssh just pipes the binary input/output of remote sftp-server, the same way as in your setup the local ssh pipes textual input/output of intermediate sftp).

But if you need both SFTP and SSH you will need to use Subsystem directive for SFTP, not ForceCommand:

Subsystem sftp ssh -s sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server

Or to avoid having to repeat the tunneling separately for SSH and SFTP, you can use SSH_ORIGINAL_COMMAND environment variable to decide whether to use -s sftp or not.

If you actually know that the (most) remote SFTP server has OpenSSH too and the same path to sftp-server binary as the intermediate server, this should cover both SSH and SFTP:

ForceCommand ssh -i /home/someuser/.ssh/id_rsa someuser@some_other_server $SSH_ORIGINAL_COMMAND
|improve this answer|||||
  • 1
    thank you ! that worked: ForceCommand ssh -i /home/someuser/.ssh/id_rsa someuser@some_other_server $SSH_ORIGINAL_COMMAND – Itai Malek Apr 3 '19 at 12:53
  • ,previous solution worked for regular users, but now I have a requirement to chroot the users login to specific dir, so the most remote machine is using internal-sftp as Subsystem and here I get a response of Connection closed. any idea how to resolve this? – Itai Malek Apr 29 '19 at 21:29
  • Please ask a new question and show us your configuration for both chrooting and tunneling. – Martin Prikryl Apr 30 '19 at 4:56
  • thanks, new question is here: unix.stackexchange.com/questions/516298/… – Itai Malek Apr 30 '19 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.