3

I have a particular setup that requires this sequence of steps:

ssh me@host1
ssh me@host2
sudo su otheruser

I have:

  • an ssh key on my laptop that allows me to ssh me@host1
  • an ssh key on host1 that allows me to ssh me@host2.

I do not have permission to ssh otheruser@host2.

My goal is: can I automate this? Preferably in my laptop's ~/.ssh/config file, so I can simply do:

ssh otheruser

...and let the config take care of the details, ideally including the password?

I can already get 2/3 of the way there with the following ssh config:

Host host1
HostName host1.example.com

Host host2
HostName host2.example.com

Host mostly_there
HostName host2.example.com
ProxyJump host1 host2

The above allows me to ssh mostly_there but I still have to sudo su otheruser.

0

2 Answers 2

2

You could use this in .ssh/config:

HOST host1
  user me

HOST host2
    USER me
    ProxyCommand ssh host1 -W %h:%p

HOST otheruser
    USER me
    ProxyCommand ssh host1 -W %h:%p
    RemoteCommand sudo su -c '/bin/bash -i' otheruser

To connect to host2 with user otheruser just use:

ssh otheruser

It currently has the drawback, that it isn't a full interactive shell, but that could be fixed by a better invocation than /bin/bash -i

4
  • By "add your public key to that user", which public key do you mean? Right now I have a key on my laptop, and a different key on host1 that allows me to ssh into host2. Oct 21, 2020 at 13:03
  • I updated my question to be more explicit about my permissions. I can't ssh otheruser@host2 from any host, which is why I have ssh and su split into 2 steps. Oct 21, 2020 at 13:23
  • @AlexShroyer You don't need to ssh otheruser@host2, that's the point of the ProxyCommand it uses host1 as an jump box. You should add your public key from your laptop to host2, it's a bad idea to store a private key on a middle host (host1 in your case)
    – jeb
    Apr 6, 2021 at 6:31
  • RequestTTY yes will help get an interactive shell Jul 19, 2023 at 19:17
0

If you have root you can deploy your public key to otheruser's authorized_keys and login without using a password. After switching to otheruser do this:

mkdir -p ~/.ssh

and put your public key into ~/.ssh/authorized_keys. You should now be able to log in remotely as otheruser just by doing ssh otheruser@host.

4
  • ssh-copy-id can be used to copy the ssh key. It just requires that sshd lets you log in via password as the other user (in some configurations a user is not allowed to log in via password or at all in sshd_config).
    – Lucas
    Oct 20, 2020 at 6:30
  • I updated my question to clarify why this does not work for me. In short, I don't have permission to log in as otheruser, nor do I have general sudo permissions. I can sudo su otheruser, but that's about it. Oct 21, 2020 at 13:51
  • @AlexShroyer: but if you can become otheruser on the remote server you can deploy your local user's public key to authorized_keys. Oct 21, 2020 at 18:15
  • oheruser does not have ssh access Oct 23, 2020 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .