I'm attempting to set up some universal options for bouncing ssh connections. Here is my
~/.ssh/config file, abbreviated:
Host *%via ProxyCommand ssh gateway -W $(echo %h | cut -d%% -f1) %p Host gateway HostName gateway.example.com User username ForwardAgent yes IdentityFile keypathg Host target User username HostName target.example.com IdentityFile keypatht
When I utilise
*%via utilising the
Host aliases, I get:
% ssh -vvv target%via OpenSSH_5.9p1, OpenSSL 0.9.8y 5 Feb 2013 debug1: Reading configuration data /Users/myuser/.ssh/config debug1: /Users/myuser/.ssh/config line 5: Applying options for * debug1: /Users/myuser/.ssh/config line 12: Applying options for *%via debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: Applying options for * debug1: auto-mux: Trying existing master debug1: Control socket "/Users/myuser/.ssh/tmp/target%via_22_myuser" does not exist debug2: ssh_connect: needpriv 0 debug1: Executing proxy command: exec ssh -A gateway -W $(echo target%via | cut -d% -f1):22 debug1: permanently_drop_suid: 501 debug1: identity file /Users/myuser/.ssh/id_rsa type -1 debug1: identity file /Users/myuser/.ssh/id_rsa-cert type -1 debug1: identity file /Users/myuser/.ssh/id_dsa type -1 debug1: identity file /Users/myuser/.ssh/id_dsa-cert type -1 ssh_exchange_identification: Connection closed by remote host
However, if I utilise
% ssh target.example.com%via
I hit the target server, but as the wrong user and with no pubkey authentication.
I think my question, at this point, is does this method of bouncing, when utilising
ForwardAgent, pass through my ssh config/environment whole, or just keys. If just keys, can the former be utilised in some way?
My ssh version is 5.9v1, gateway is 5.9v1, and target is 5.3p1. I believe
-W was introduced in 5.4, but that should not matter for the final box in line? utilising the older school
nc seems no different.
I have verified that I can manually ssh to each box in the line. Doing so indicates that hostname alias information is not passed, as when on gateway, I cannot
ssh target but I can
ssh target.example.com. This works with pubkey auth. gateway and target incidentally have the same username, which is why this works if no config is pushed.
ForwardAgent or similar config can't push this information, what's the sanest way to get around it, keeping a .ssh/config on gateway with this information?