0

What I would like to achieve is to be able to connect to some target.server from my local machine, without having to type any passwords, with the following commands:

ssh user1@target.server
ssh user2@target.server

Each user above only accepts a connection from a specific IP address, corresponding to respectively gateway1.example and gateway2.example. I have added all necessary SSH keys to the right authorized_keys, so that I can do, without typing passwords:

  • ssh gateuser1@gateway1.example from local machine, then ssh user1@target.server from gateway1.
  • ssh gateuser2@gateway2.example from local machine, then ssh user2@target.server from gateway2.

Now I think it remains to put the right things in my local ~/.ssh/config. When I add:

Host target.server
    ProxyCommand ssh -o 'ForwardAgent yes' gateuser1@gateway1.example 'ssh-add && nc %h %p'

Then ssh user1@target.server works. But I don't know how to make both user1 and user2 work. I tried:

Host target.server
    User user1
    ProxyCommand ssh -o 'ForwardAgent yes' gateuser1@gateway1.example 'ssh-add && nc %h %p'
Host target.server
    User user2
    ProxyCommand ssh -o 'ForwardAgent yes' gateuser2@gateway2.example 'ssh-add && nc %h %p'

or

Host target.server
    User user1
        ProxyCommand ssh -o 'ForwardAgent yes' gateuser1@gateway1.example 'ssh-add && nc %h %p'
    User user2
        ProxyCommand ssh -o 'ForwardAgent yes' gateuser2@gateway2.example 'ssh-add && nc %h %p'

but it still didn't work for user2: all went through gateway1 and not gateway2.

Thank you very much in advance for your help!

Update: I've been able to make the following commands work:

ssh user1
ssh user2

(without @target.server), using the following configuration:

Host user1
    HostName target.server
    User user1
    ProxyCommand ssh -o 'ForwardAgent yes' gateuser1@gateway1.example 'ssh-add && nc %h %p'
Host user2
    HostName target.server
    User user2
    ProxyCommand ssh -o 'ForwardAgent yes' gateuser2@gateway2.example 'ssh-add && nc %h %p'

This is what I will be using, but I'm still curious to see a solution to the two commands at the beginning of this question.

2

As you figured out, aliases are a good solution. If you don't want to use them, the Match directive might be another valid option.

Host target.server
    Match User user1
        ProxyCommand ssh -o 'ForwardAgent yes' gateuser1@gateway1.example 'ssh-add && nc %h %p'
    Match User user2
        ProxyCommand ssh -o 'ForwardAgent yes' gateuser2@gateway2.example 'ssh-add && nc %h %p'

From the ssh_config man page:

Match Restricts the following declarations (up to the next Host or Match keyword) to be used only when the conditions following the Match keyword are satisfied.

| improve this answer | |
  • I tested and it worked! Great answer. Thank you! – Khue Apr 2 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.