Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to set SSH up so that for any attempted connection it first tries to connect directly, if that fails it tries to connect via another host. If that fails, it tried to connect via another host and so on. I have a list of such hosts.

For example

sshing into ""

would first try directly, but it would fail (no key signed)

Then it would try to go via and that would also fail

Then it would try to go via and that would succeed.

I know transparent forwarding can be done on a host-by-host basis, but is it possible to do this?

share|improve this question
Do you mean you have credential as well as and and want to try if connection are accepted directly, from and from ? – M'vy Jul 2 '12 at 11:53
I mean, for ANY host I attempt to connect to, it should first attempt to connect directly. Only if that fails should it go down the list of intermediate hosts to try, to see if any of them are authorised. The point of this is to be able to SSH into any of my company's servers, even when I don't have authorisation on them (I do have authorisation on the "master" intermediate servers) – Rory Jul 2 '12 at 12:22

First of all, we can set up proxy connection.

Let's consider you want to access, but you need to go through before. We can edit our .ssh/config file with :

Host A-s1
Compression yes
User mvy
ProxyCommand ssh nc %h %p 2> /dev/null

this enable us to do

ssh A-s1

It will ask for B password, then A password, then we're in. That way you can do :

ssh A-s1 exit

If $? is 0 then this is a success and you can connect with the pass-through.

All you need now is a script that try connection for each server and print the result of $?

share|improve this answer
This looks like it should work, but I get asked:'s password: (names changed to match example) Now I know that can log into, so I don't know what's happening here. – Rory Jul 2 '12 at 13:01
Not sure what you need, but you can change the username you need to connect on A with the User directive, and put a user@ before if you need to connect to B using another username. – M'vy Jul 2 '12 at 13:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .