onion-style encryptions in ssh multi-hop commands

Question

In what we could call the canonical multi-hop ssh example, we can see that the following command would route the user's ssh traffic through three (fictitious) consecutive nodes:

ssh ruapehu.example.com ssh aoraki ssh tongariro

named ruapehu.example.com, aoraki, and tongariro. The example simplifies the configuration by using proxy commands. One weakness in the scheme is that the first two nodes can read the traffic, while it would be better if they cannot do so. If we manage to introduce the commands [encrypt] and [decrypt] in the chain, we may actually come close to what the tor network does. Another problem is how to introduce port forwarding in the multi-hop chain? The following will obviously not work, but it is pretty much what I would want to do:

[encrypt] ssh ruapehu.example.com ssh aoraki ssh tongariro [decrypt] -L 80:somesite.com:80

Would anybody be able to make something like that work?

Answer 1

You asked two questions:

1. How can we ensure that the traffic through the intermediate hosts is not 'sniffed'?

The answer is you don't need to do anything. EACH ssh connection is encrypted. The traffic "seen" by ruapehu and aoraki is not in the clear. You don't need to add any additional encryption layer.

2. How can you enable port forwarding through to the destination?

Easiest answer is to use the ~/.ssh/config file and add a directive for the destination only, as in (borrowing from your own reference, adding only the last line):

Host ruapehu
  HostName ruapehu.example.com

Host aoraki
  ProxyCommand ssh -q ruapehu nc -q0 aoraki 22

Host tongariro
  LocalForward 80:somesite.com:80
  ProxyCommand ssh -q aoraki nc -q0 %h 22

That is, assuming you can open port 80 on your local host, otherwise you might have to use a non-privileged port, something above 1024 (depending upon your host and configuration).

Answer 2

If you create forwarded port from your machine to the target machine in one step and then issue SSH connection over that forwarded port, you reach basically what you described in your last example.

1. Create the port forwarding:

   # jump from aoraki -> tongariro
   ssh ruapehu.example.com "ssh -L 2222:tongariro:22 aoraki" 
   # jump from ruapehu.example.com -> aoraki
   ssh -L ruapehu.example.com:2222:aoraki:2222 ruapehu.example.com
   

   This expects you have set up your server with appropriate GatewayPorts, so you will be able to bind the port 2222 from outside.

2. Initiate new ssh connection to the target server:

   ssh -p 2222 ruapehu.example.com
   

   This connection will be encrypted over all the intermediate steps and you can also set up another port forwarding through it.