Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to know whether there is a way to assign a default ssh gateway to a hostname such that, whenever you attempt to ssh to the hostname it uses the gateway to reach the host. Ideally this should be done in the ssh_config

e.g.: client C attempts to reach target T by

ssh T

The only way this connection can be established is through gateway GW

ssh -tA GW ssh T

EDIT: I neglected to mention that one may have various gateways which will reach different hosts

EDIT: I tried using the ssh config:

Host my-target-host
ProxyCommand ssh -tA GW ssh %h

But then I get "Pseudo-terminal will not be allocated because stdin is not a terminal"

EDIT: Okay so I figured it out :-) The correct config looks like this:

Host my-target-host
ProxyCommand ssh my-gateway-host exec nc %h %p

Not entirely sure why this works though...

share|improve this question
If you found a solution to your question, please post it as an answer and accept it as the correct solution later. Thanks :) – Oliver Salzburg May 26 '12 at 14:39
I would love to know why it works... How does netcat know to use my forwarded ssh-agent? What about all the particulars about the ssh protocol, how does netcat know this? – jabalsad May 26 '12 at 14:45
That might already be a new question. In that case, ask a new question and add a link to this one. – Oliver Salzburg May 26 '12 at 14:56
up vote 2 down vote accepted

After some tinkering and searching, I found that this works (for reasons that are beyond me):

In your ssh_config:

Host my-target-host
ProxyCommand ssh my-gateway-host exec nc %h %p
share|improve this answer
This command causes your local SSH client to establish two SSH sessions. The first is to the gateway host where it starts netcat to serve as a dumb proxy to the target host. The second is via the netcat proxy to the target host. Because it is a proxy, your local ssh-agent (not the gateway) serves the key. – Jeremy W May 26 '12 at 15:22
That makes sense, thanks. – jabalsad Jun 7 '12 at 8:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.