1

I recently discovered that with ~/.ssh/config, I can save a lot of keystrokes and automate long command lines, specifying a lot of per-host defaults. Now that I noticed how powerful the tool can be, I am wondering if it can fit another of my use cases.

I have access to two hosts, bastion and wikispy. Bastion has an external IP, wikispy is only visible from the internal one. This means that normally in order to connect to wikispy, I need to ssh to bastion first and then call ssh wikispy. Obviously things like port forwarding are going to be complicated this way and this is something I would like to avoid.

This leads to a question: can I somehow make ~/.ssh/config entry that would tell "when the user requests host labeled wikispy, actually connect to bastion, then call ssh wikispy"? Would it be possible to work transparently so that I could call things like ssh wikispy -L 9999:localhost:9999 and have bastion forward the port in a way that would let me access it from inside of wikispy?

Improve this question
1

1 Answer 1

Reset to default
1

Looks like this is where a combination of ProxyCommand and nc proves useful. Here's a solution - add the following to ~/.ssh/config:

Host bastion
HostName EXTERNAL_IP
User d

Host wikispy
HostName INTERNAL_IP
User d
ProxyCommand ssh bastion nc -q0 %h 22

According to this article, you can get more than a single level of nesting this way.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .