Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Not sure how to phrase this exactly. I have a school web server which I have to access to sshing to one server, and then from there ssh to another. Is there anyway I can set something up to bypass the first server, so I can access the 2nd server directly?


Perhaps I should mention that I'm working from my home windows machine. I've mentioned sshing, but like the title says, I want to FTP my files using something like FileZilla, not some command-line interface (PuTTy).

share|improve this question
    
Duplicate: superuser.com/questions/49838/… –  Arjan Oct 6 '09 at 17:00
    
@Arjan true, but better answers have arisen. how are dupes handled? does the original get links to the dupes, or do we have to replicate useful answers to the original by hand? (yes i know that's better for meta....) –  quack quixote Oct 6 '09 at 17:39
    
@~quack, true, meanwhile answers have been posted that were not posted at the other question. Too bad, if you'd ask me, but well. –  Arjan Oct 6 '09 at 21:15
add comment

4 Answers

You might want to check out OpenSSH's ProxyCommand, which allows you to specify an arbitrary command to establish a tunnel. In this case, you'd use an ssh connection to the first server, running something like netcat to connect to the second server. This is especially handy if you use public key authentification to connect to the first server, otherwise, you need to enter two passwords.

The relevant .ssh/config-snippet looks like this:

Host hidden-server
HostKeyAlias hidden-server
ProxyCommand ssh first-server nc -w1 hidden-server 22
share|improve this answer
    
Hang on, I put this file on the first server? –  Mark Oct 6 '09 at 18:19
    
you'd use this on your local client. the client is your starting point. the first-server is the proxy, the route you need to take to get to your destination. the hidden-server is the destination. –  quack quixote Oct 6 '09 at 18:57
    
My local machine is windows... I've been using PuTTy... how would this work? –  Mark Oct 6 '09 at 20:44
    
it's an OpenSSH feature, which is a particular SSH implementation. PuTTY doesn't use .ssh/config so you'd need to install OpenSSH (via Cygwin is one way) or use a different solution. –  quack quixote Oct 7 '09 at 0:05
add comment

~/.ssh/config:

Host internalmachine.mynet.com
    ProxyCommand ssh gateway.mynet.com exec nc %h %p
share|improve this answer
    
And then what? When I try to connect to the first server via my favorite ftp program it will reroute to the 2nd server? –  Mark Oct 6 '09 at 18:33
    
Rather than 2 SSH connections, this will get you straight to the internal host, so whatever you normally do once you get to that point will work. Notably, this is only going to work for SSH. Not FTP. –  phresus Oct 6 '09 at 18:53
    
If you want to do this via FTP, the easiest way would be to set up SSH port forwarding via the same ProxyCommand. –  phresus Oct 6 '09 at 18:53
add comment

Well, it depends. If the second server actually has a routable address (ie, its IP doesn't start with 10 or 192.168 or 172.16..-172.31..), then it should be possible. Except that its SSH server might only allow connections from the first server that you connect to. There are good security reasons for doing this - namely, that a public SSH server that does something important (like serving web pages) generally likes to be accessible from only a few IP addresses in order to keep people from breaking the passwords with dictionary attacks.

We are not the people to ask this question of. You should ask the administrator of the system in question why this is, and possibly if you can get your (fixed!) IP address set up as a trusted address on the final SSH server.

share|improve this answer
    
+1 security insight. you're wrong that we aren't the people to ask -- he asked about setting something up to bypass it (read: "make it easier on the user"), not why it was set up that way. but your explanation of the related issues is worthy. –  quack quixote Oct 6 '09 at 17:45
    
Perhaps, but ultimately the administrator can provide the most elegant solution. All we can do is suggest ugly hacks to work around the "problem". –  Ernie Dunbar Oct 6 '09 at 18:04
1  
nope. intelligently configuring SSH to do two logins with one user action isn't an "ugly hack" -- it's understanding the situation and working with the tools. the admin doesn't want to provide the user with solutions; they want to admin. –  quack quixote Oct 6 '09 at 18:53
    
It's for a school project... we'll be using it for about 4 months just to show our work to the prof... I don't think security is paramount. It's just a pain in the butt to have to transfer files to the first server, and then try and remember the darn linux command to move em to the second... every time I want to edit a stinkin file. –  Mark Oct 6 '09 at 18:54
    
As a systems administrator, any admin that doesn't want to provide the user with solutions is a damn poor admin. They may as well shut down the server if they don't want to provide solutions to users. The entire raison d'etre of servers is to provide service. There are much better, much more secure solutions to this security problem than the one that is in place. For example, the admin could assign you a key with which to log in, instead of using passwords, then disable all password logins. –  Ernie Dunbar Oct 6 '09 at 23:47
add comment
up vote 0 down vote accepted

Just found out you can use PuTTY to set up a tunnel, and then connect to it with whatever FTP program you want. Works great :)

(For whoever needs that solution as well: see How to transfer files when given two SSH accounts?)

ExpanDrive also works wonderfully and is incredibly easy to use.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.