put two ssh hops in an ssh:// URI?

Question

To ssh onto a box behind some firewall I can do the following

home$ ssh me@ssh-server
ssh-server$ ssh me@box-behind-firewall
box-behind-firewall$

So that I can do things like use git repos etc on box-behind-firewall from outside the network, I want to combine these into a single uri, e.g. something like

ssh://me@ssh-server/;ssh://me@box-behind-firewall/some/path

Is this possible, and how's it done?

Answer 1

You want to use ProxyCommand to tunnel through the intermediate system.

Answer 2

You probably want to use port forwarding. Connect the the first machine using

ssh -L2222:box-behind-firewall:22 me@ssh-server

While that connection is active, you can connect to the second machine using

ssh -p 2222 me@localhost

from you local machine or access git repositories on the server using

ssh://me@localhost:2222/foo/bar/baz

as URI.

Answer 3

This is not possible the way you want. You would need to execute some command after logging in which ssh-URI-scheme does not support - I guess due to security concerns.

If you could run a command, you could directly do an ssh to the next server while connecting.

But you can do it with some workaround. This line's from man sshd

8. If ~/.ssh/rc exists, runs it[...]

You could just add the ssh-command to the next server (or firewall/router) here. You just need to find some way to distinguish if you want to connect the "normal" way or want to be forwarded to the router - maybe you're able to just add an user on the first server which only has the purpose to forward you to the next server?