How can I download a file from a host I can only SSH to through another host?

Question

I want to download files from my office computer to my laptop.

I can connect my office machine by SSH to the organization server and then SSH from the server to my office machine.

The only commands the organization server accepts are ssh, ssh1, and ssh2.

How can I download a file from my office (remote) machine through the server into my laptop (local) machine?

Answer 1

If you have a recent OpenSSH (8.0) locally, you can use the -J (jump) switch:

scp -J user@intermediate user@target:/path

---

With older versions (but at least 7.3), you can use ProxyJump directive, either on command-line:

scp -o ProxyJump=user@intermediate user@target:/path

or in ssh_config file, as the answer by @Ángel shows.

---

There are other options like ProxyCommand or port forwarding, which you can use on even older versions of OpenSSH. These are covered in Does OpenSSH support multihop login?

Answer 2

The previous answers mention how to use the ProxyJump directive (added in OpenSSH 7.3) to connect through an intermediate server (usually referred to as the bastion host), but mention it just as a command line argument.

Unless it is a machine you won't be connecting in the future, the best thing is that you configure it on ~/.ssh/config.

I would put a file like:

Host office-machine
Hostname yochay-machine.internal.company.local
ProxyJump bastion-machine

Host bastion-machine
Hostname organization-server.company.com
...

If you are using an earlier version of OpenSSH which doesn't support ProxyJump, you would replace it with the equivalent:

ProxyCommand ssh -W %h:%p bastion-machine

and if your local ssh version was a really ancient one that didn't support -W:

ssh bastion-machine nc %h %p

although this last one requires that the bastion machine has nc installed.

The beauty of ssh is that you can configure each destination on the file, and they will stack very nicely. Thus you end up working with office-machine as the hostname on all the tools (ssh, scp, sftp...) as they were direct connects, and they will figure out how to connect based in the ssh_config. You could also have wildcards like Host *.internal.company.local to make all hosts ending like that going through a specific bastion, and it will apply to all of them. Once configured correctly, the only difference between doing one hop connections or twenty would be the slower connection times.

Answer 3

Sometimes we can just use the pipeline. That time is today.

ssh -A user@host1 ssh user@host2 cat filename > filename

You can upload too

ssh -A user@host1 ssh user@host2 cat \\\> filename < filename

Yeah there are other solutions involving proxying, etc. but knowing how to do this is useful.

Answer 4

Use the ProxyJump configuration:

ProxyJump
Specifies one or more jump proxies as either [user@]host[:port] or an ssh URI. Multiple proxies may be separated by comma characters and will be visited sequentially. Setting this option will cause ssh(1) to connect to the target host by first making a ssh(1) connection to the specified ProxyJump host and then establishing a TCP forwarding to the ultimate target from there.

scp -o ProxyJump=user@intermediate user@target:/path

Answer 5

There is an ancient protocol called ZMODEM: few programs support it these days, but when it works, it can be pretty convenient.

First check if your laptop's terminal program supports ZMODEM. (For example, you can configure iTerm2 (on Mac) to support ZMODEM. An example script is available here.)

In your office machine, run: sudo apt install lrzsz

Now all you have to do is ssh to your office machine, and run sz (filename). The file will be downloaded via your terminal.

Answer 6

Configuration under ssh of user: ~/.ssh/config

Host *
    UserKnownHostsFile=/dev/null
    StrictHostKeyChecking=no
    ServerAliveInterval 300
    ServerAliveCountMax 2
    ForwardAgent yes


Host jump server
    HostName server.company.org
    User root

Host jump1 server1
    HostName server1.dmz.company.org
    User root
    ProxyJump jump

Host jump2 server2
    HostName server.dmz2.company.org
    User root
    ProxyJump jump1

Host *.intranet.company.org
    User user
    ProxyJump jump2

You can copy now from intranet server directly over 3 jump server.

scp [email protected]:/home/user/ ./*

I preffer this because of no longer need to specify jump servers with scp

Answer 7

Via SCP -3:

scp -3 user1@remote1:/root/file1.txt user2@remote2:/root/file1.txt

Answer 8

This is what worked for me:

scp -o 'ProxyJump user@intermediate' user@target:/fiepath .

The . at the end indicate target download path is the current folder