How can I configure ~/.ssh/config such that `ssh foo.bar` results in a connection to `foo.internal.bar`?

Question

I have a system with both a public (e.g server1.foo.bar) and privately-resolvable (e.g. server1.internal.foo.bar) DNS name. SSH connections are only possible via the private IP, but I always think of these hosts in terms of their public name.

I would like to:

• connect to the right IP regardless of whether I remember to use the *.internal.bar pattern
• save keystrokes

I'm aware of the substitution tokens such as %h that can be used to modify the hostname given at the commandline, e.g.

Host foo
    Hostname %h.some.other.domain

The behavior I'm looking for would be something like:

Host *.foo.bar
    Hostname %m.internal.foo.bar

Where %m gets substituted with just the portion of the given hostname up to the first dot. I've read man 5 ssh_config as well as https://man.openbsd.org/ssh_config and couldn't find the answer, if one even exists. I'm using macOS 10.15.4:

$ ssh -V
OpenSSH_8.1p1, LibreSSL 2.7.3

Answer 1

I figured out a working method. It's a bit ugly, but it does work. This leverages the ProxyCommand directive (see manpage) combined with a small bash helper script.

1. Add sections like this to ~/.ssh/config — one for each domain you want remapped:

Match final host="!*.corp.foo.com,*.foo.com"
    ProxyCommand ssh_ext2int %h %p

Match final host="*.quux.biz"
    ProxyCommand ssh_ext2int %h %p

2. Save this in your $PATH somewhere as ssh_ext2int — and chmod u+x it:

#!/usr/bin/env bash

[ $# -eq 2 ] || exit 1
typeset -A dmap
dmap=(
  [foo.com]=corp.foo.com
  [quux.biz]=internal.qux.lan
)

d=${1#*.}
h=${1%%.*}
nd=${dmap[$d]:-$d}

/usr/bin/nc -w 120 $h.$nd $2 2>/dev/null

Now, ssh server158247.quux.biz should connect you to server158247.internal.qux.lan

Answer 2

This particular thing you ask for is not possible with OpenSSH. These constructs are really meant only for simple aliases and not for complex replacements such as you ask. If these servers have some specific format, you can make them aliases (without the domain name):

Host server*
    Hostname %h.internal.foo.bar

If you need some more complex matches for the aliases (lets say you have a file containing all your hosts. This can be either manually created or automatically updated from DNS), you can use something like this

Match exec "grep %h %d/.ssh/internal_hosts"
    Hostname %h.internal.foo.bar

The last resort is to generate the ssh_config from the above list/DNS, which will have the whole hardcoded items for all your hosts. It does not have to be the main configuration file, but just some included one. The configuration files are really just a text files.