SSH Config - Multiple proxy configurations

Question

I'm wanting to try and set up an easy way to manage my SSH proxy settings. I find I often want to SSH to my server from three different locations - two locations each have their own proxy server which I need to use corkscrew in order to get to the outside world, and one which doesn't have a proxy server at all. Is there a way that I can set up my ~/.ssh/config file to recognise which ProxyCommand to use? The reason I'd like to do this is that I want to set up Fetchmail to tunnel through my server over SSH (using crontab), and I can't figure out how to make this work no matter which network I'm on.

Cheers.

Answer 1

You can do per-host configuration in your .ssh/config:

Host ex1
HostName proxied.example.com
User myuser
ProxyCommand /usr/local/bin/corkscrew proxy.example.com 8080 %h %p

Host ex2
HostName nonproxy.example.com
User myuser
IdentityFile id_rsa

So

ssh ex1

would ssh to proxied.example.com and invoke the corkscrew proxy, and

ssh ex2

would ssh to nonproxy.example.com and use the identity file from your .ssh folder.

Automatic Detection

What the corkscrew proxy does it creates a connection through the local proxy, and accepts input on standard-in for ssh to connect through. You can use anything as a ProxyCommand provided it connects to the remote ssh server somehow, and accepts input on standard in.

For example, you could use netcat to establish the connection to the remote host and ssh would talk to netcat via standard-in:

ProxyCommand nc %h %p

When you ssh to a server with this proxy command, ssh would invoke nc to make the tcp connection to the remote host on port 22 then ssh would send its commands through the standard-in of nc.

This would serve no purpose, having nc establish the tcp session instead of ssh doesn't give you anything. Except you could create a wrapper script called "proxytest" for example, that did a test to see if a direct connection could be established using nc, and and otherwise tried to use corkscrew - something like:

if nc -z $1 $2; then
   exec nc $1 $2  # try to connect directly
else
   exec corkscrew $3 $4 $1 $2  # set up proxy connection

So if either of these work, then there will be a standard-in available that ssh can use to connect - either by the one from netcat or the one from corkscrew. So your ssh config would have:

ProxyCommand proxytest %h %p proxy.example.com 8080

There is a ready made script here that you may want to try out, with proper tests and error checking. Scroll down to the "Other Tricks" section.