Saturday, July 9, 2016

ubuntu - How to configure a shortcut for an SSH connection through a SSH tunnel



My company production servers (FOO, BAR...) are located behind two gateway servers (A, B). In order to connect to server FOO, I have to open a ssh connection with server A or B with my username JOHNDOE, then from A (or B) I can access any production server opening a SSH connection with a standard username (let's call it WEBBY).



So, each time I have to do something like:



ssh johndoe@a
...

ssh webby@foo
...
# now I can work on the server


As you can imagine, this is a hassle when I need to use scp or if I need to quickly open multiple connections.



I have configured a ssh key and also I'm using .ssh/config for some shortcuts.



I was wondering if I can create some kind of ssh configuration in order to type




ssh foo


and let SSH open/forward all the connections for me. Is it possible?



Edit



womble's answer is exactly what I was looking for but it seems right now I can't use netcat because it's not installed on the gateway server.




weppos:~ weppos$ ssh foo -vv
OpenSSH_5.1p1, OpenSSL 0.9.7l 28 Sep 2006
debug1: Reading configuration data /Users/xyz/.ssh/config
debug1: Applying options for foo
debug1: Reading configuration data /etc/ssh_config
debug2: ssh_connect: needpriv 0
debug1: Executing proxy command: exec ssh a nc -w 3 foo 22
debug1: permanently_drop_suid: 501
debug1: identity file /Users/xyz/.ssh/identity type -1
debug2: key_type_from_name: unknown key type '-----BEGIN'

debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /Users/xyz/.ssh/id_rsa type 1
debug2: key_type_from_name: unknown key type '-----BEGIN'
debug2: key_type_from_name: unknown key type 'Proc-Type:'
debug2: key_type_from_name: unknown key type 'DEK-Info:'
debug2: key_type_from_name: unknown key type '-----END'
debug1: identity file /Users/xyz/.ssh/id_dsa type 2
bash: nc: command not found

ssh_exchange_identification: Connection closed by remote host

Answer



As a more concrete version of Kyle's answer, what you want to put in your ~/.ssh/config file is:



host foo
User webby
ProxyCommand ssh a nc -w 3 %h %p

host a

User johndoe


Then, when you run "ssh foo", SSH will attempt to SSH to johndoe@a, run netcat (nc), then perform an SSH to webby@foo through this tunnel. Magic!



Of course, in order to do this, netcat needs to be installed on the gateway server; this package is available for every major distribution and OS.


No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...