I'm attempting to set up some universal options for bouncing ssh connections. Here is my ~/.ssh/config
file, abbreviated:
Host *%via
ProxyCommand ssh gateway -W $(echo %h | cut -d%% -f1) %p
Host gateway
HostName gateway.example.com
User username
ForwardAgent yes
IdentityFile keypathg
Host target
User username
HostName target.example.com
IdentityFile keypatht
When I utilise *%via
utilising the Host
aliases, I get:
% ssh -vvv target%via
OpenSSH_5.9p1, OpenSSL 0.9.8y 5 Feb 2013
debug1: Reading configuration data /Users/myuser/.ssh/config
debug1: /Users/myuser/.ssh/config line 5: Applying options for *
debug1: /Users/myuser/.ssh/config line 12: Applying options for *%via
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: auto-mux: Trying existing master
debug1: Control socket "/Users/myuser/.ssh/tmp/target%via_22_myuser" does not exist
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec ssh -A gateway -W $(echo target%via | cut -d% -f1):22
debug1: permanently_drop_suid: 501
debug1: identity file /Users/myuser/.ssh/id_rsa type -1
debug1: identity file /Users/myuser/.ssh/id_rsa-cert type -1
debug1: identity file /Users/myuser/.ssh/id_dsa type -1
debug1: identity file /Users/myuser/.ssh/id_dsa-cert type -1
ssh_exchange_identification: Connection closed by remote host
However, if I utilise
% ssh target.example.com%via
I hit the target server, but as the wrong user and with no pubkey authentication.
I think my question, at this point, is does this method of bouncing, when utilising ForwardAgent
, pass through my ssh config/environment whole, or just keys. If just keys, can the former be utilised in some way?
My ssh version is 5.9v1, gateway is 5.9v1, and target is 5.3p1. I believe -W
was introduced in 5.4, but that should not matter for the final box in line? utilising the older school nc
seems no different.
I have verified that I can manually ssh to each box in the line. Doing so indicates that hostname alias information is not passed, as when on gateway, I cannot ssh target
but I can ssh target.example.com
. This works with pubkey auth. gateway and target incidentally have the same username, which is why this works if no config is pushed.
If ForwardAgent
or similar config can't push this information, what's the sanest way to get around it, keeping a .ssh/config on gateway with this information?