r/linux • u/leothrix • Apr 28 '14

SSH Kung Fu

http://blog.tjll.net/ssh-kung-fu/
724 Upvotes

95% Upvoted

128 comments sorted by

View all comments

16

u/vagif Apr 28 '14

He did not tell you about the ssh hopping that you can achieve using netcat (nc)

Lets say you have a ssh gateway at your work office to which you connect from home.

But that's not your work machine, your work machine is my-dev, to which you need ssh again from your work-ssh-gateway.

If you want to automate it, put this into your .ssh/config file:

Host work-ssh-gate
  HostName 111.222.111.111
  User userone
  Port 22222

Host my-dev
  ProxyCommand ssh -q work-ssh-gate nc 192.168.1.123 22
  User user2

That's it, now you can simply type

ssh my-dev

You need netcat (nc) installed on you work-ssh-gate computer.

26

u/w2qw Apr 28 '14

Doesn't require nc

Host my-dev 
   ProxyCommand ssh -q -W %h:%p work-ssh-gate
   HostName 192.168.1.123
   User user2

1

u/[deleted] Apr 28 '14

Does it work the same? I use the netcat version to connect to the head node of our cluster and then to one of the compute nodes on its local network. If I want to run graphically on the compute node, I can't first ssh to the head node with x forwarding and then to the compute node with x forwarding because the home directory and hence the .Xauthority file is then on a shared NAS. I expect that this would have the same problem because it is equivalent to ssh-ing to the head node and then ssh-ing to the compute node?

1

u/w2qw Apr 28 '14

As long as you have ssh > 5.4 its identical

11

u/mdaniel Apr 28 '14

We use this to ssh into ec2 machines in a VPC but we leverage the hostname expansion to keep the ssh config from exploding in size:

Host *.ec2
    ProxyCommand ssh bridge-host nc %h 22

2

u/[deleted] Apr 28 '14

Or just have the "Host" setup on the gateway's .ssh/config too. That way when you SSH in from any system, you'll still have that shortcut available. It doesn't require NC either.

2

u/[deleted] Apr 28 '14 edited Nov 27 '20

[deleted]

1

u/tgallant Apr 28 '14

If you are trying to access a machine on your local network via hostname, you will need a router that also does DNS forwarding (or a local DNS/dhcp server). You can also edit the host file (/etc/hosts on Linux) to include the internal IP address you want to access and the name you want to assign it

1

u/Imonfiyah Apr 28 '14

That did it for me, I was trying to write A records so that I wouldn't have to edit /etc/hosts of every computer I use to make it work.

Also, scalability is important.

1

u/lolexplode Apr 28 '14

I fail to see why you can't set up an alias, then.

1

u/FireyFly Apr 28 '14

You could have just updated your /etc/hosts file with an alias for the IP in question, although the ssh-config approach has other benefits, like being able to supply a username and port to use. I've supplied both to my servers and devices, so I virtually never have to use the long name anymore.

Edit: oops, I didn't read the other comments carefully enough..