I want to establish an SSH Server so that it acts as a SSH proxy or a gateway between users and the actual upstream SSH server so that users do not access the upstream directly. I may need to have different auth methods between user to proxy and proxy to upstream, (e.g. user has no authentication or password while proxy accesses upstream with public key auth). Is this possible with the vanilla ssh binary?

I don't need SSH TCP forwarding or a VPN over SSH. I just need some kind of an nginx for SSH. The users transparently access the upstream while the upstream doesn't add the users keys as authorized.

  • The keyword you are looking for is jump host, also called "bastion". There's a wide range of ways to configure that on all involved sides depending on your use cases. Yes, sshd suffices. – dirkt Jun 13 at 14:14
  • Thanks. I am not sure whether this is really what I need. As fair as I understood it needs the client to do ssh -J <bastion-host> <remote-host> and that breaks the whole point of a transparent proxy. – Kri Noe Jun 13 at 15:45
  • You can configure that in ~/.ssh/config. If the main point is that you want to do this transparently, without the user noticing, then that's an unusual use case, and I am not sure if you gain anything by this security-wise. But I guess fiddling with the sshd config to run commands on login, or alternative fiddling the the profiles to execute the next jump should work. – dirkt Jun 13 at 17:09
  • Here is the thing, I don't want users to have any change on their side, just their normal ssh but into the proxy server. The proxy server is just an exposed Kubernetes service that periodically rotates passwords dynamically or have no auth but bounded to specific private networks. And the ssh proxy deals as the client with the usual public key auth method with the upstream. Is there anything like an ssh proxy that's open source and credible? I've found a couple of golang projects but mostly for learning stuff not for real production uses. – Kri Noe Jun 13 at 17:20
  • Why not try sshd (open source and credible) with the methods I outlined? – dirkt Jun 13 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.