My company production servers (FOO, BAR...) are located behind two gateway servers (A, B). In order to connect to server FOO, I have to open a ssh connection with server A or B with my username JOHNDOE, then from A (or B) I can access any production server opening a SSH connection with a standard username (let's call it WEBBY).
So, each time I have to do something like:
ssh johndoe@a
...
ssh webby@foo
...
# now I can work on the server
As you can imagine, this is a hassle when I need to use scp
or if I need to quickly open multiple connections.
I have configured a ssh key and also I'm using .ssh/config for some shortcuts.
I was wondering if I can create some kind of ssh configuration in order to type
ssh foo
and let SSH open/forward all the connections for me. Is it possible?
Edit
womble's answer is exactly what I was looking for but it seems right now I can't use netcat because it's not installed on the gateway server.
weppos:~ weppos$ ssh foo -vv
OpenSSH_5.1p1, OpenSSL 0.9.7l 28 Sep 2006
debug1: Reading configuration data /Users/xyz/.ssh/config
debug1: Applying options for foo
debug1: Reading configuration data /etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec ssh a nc -w 3 foo 22
debug1: permanently_drop_suid: 501
debug1: identity file /Users/xyz/.ssh/identity type -1
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /Users/xyz/.ssh/id_rsa type 1
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /Users/xyz/.ssh/id_dsa type 2
bash: nc: command not found
ssh_exchange_identification: Connection closed by remote host
Answer
As a more concrete version of Kyle's answer, what you want to put in your ~/.ssh/config
file is:
host foo
User webby
ProxyCommand ssh a nc -w 3 %h %p
host a
User johndoe
Then, when you run "ssh foo", SSH will attempt to SSH to johndoe@a
, run netcat
(nc
), then perform an SSH to webby@foo
through this tunnel. Magic!
Of course, in order to do this, netcat needs to be installed on the gateway server; this package is available for every major distribution and OS.
No comments:
Post a Comment