I have access to a server using SSH using the command line:

ssh my-server

with this .ssh/config file:

Host *
 AddKeysToAgent yes
 UseKeychain yes
 IdentityFile ~/.ssh/id_rsa

 Host my-server
  User user
  ProxyJump some.proxy.com
  IdentityFile ~/.ssh/id_rsa

However, if I want to create a tunnel with the server to access it via browser for example using:

sudo ssh -L 80:my-server:80 my-server

I get the following error:

ssh: Could not resolve hostname my-server: nodename nor servname provided, or not known

I would guess that using ssh this way ignores the proxy which is configured in the .ssh/config file. Is this correct or am I missing something else? Is there something else I can try?

  • I'm not sure of the details, but I don't think server names in the -L option get resolved via the ~.ssh/config file. What happens if you use sudo ssh -L 80:127.0.01:80 my-server instead? – Gordon Davisson Sep 4 '18 at 19:50
  • Thanks for your comment but I get the same Could not resolve hostname my-server ... error. – Peter Sep 5 '18 at 7:35
  • Does it work without the tunnel (-L part) at all? If not, I'd suspect some weird difference in how the hostname is spelled (like plain ASCII dash vs. fancy unicode dash) or weird formatting in the config file. Try printing the config file with LC_ALL=C cat -vet ~/.ssh/config and see if anything looks weird (other than the "$" at the end of each line -- cat -e does that to show where the line ends are). If the lines have a "^M" before the "$", you have a DOS/Windows formatted file, and that will absolutely cause trouble. – Gordon Davisson Sep 5 '18 at 13:41
  • It's not working with the -L part but the .ssh/config file seems to be okay (no strange formatting or DOS line endings). Does the ssh -L ... commands even uses the ProxyJump entry in the .ssh/config file on default? – Peter Sep 5 '18 at 13:54
  • My understanding is that -L shouldn't affect the ProxyJump entry at all. It should make the SSH connection from client -> some.proxy.com ->, and then once that's set up and a connection's received on the local port 80, tell the remote end ( to open a connection to my-server:80. And AIUI the resolution of "my-server" into an address to connect to is done via a normal hostname lookup on the remote computer (, completely ignoring any config file(s). – Gordon Davisson Sep 5 '18 at 15:16

After chasing some red herrings in the comments, I'm pretty sure the actual problem has nothing to do with either ProxyJump or the -L tunnel; it's because of sudo. Running sudo ssh runs the ssh command under the root user ID, and hence it will look for .ssh/config under the root account's home directory instead of yours. And ~root/.ssh/config doesn't have an entry for my-server (if it even exists).

You should be able to fix this by adding -F ~/.ssh/config to the ssh options, to tell is to use your config file rather than root's. Note that the ~/ part will be expanded by the shell before it's passed to sudo (and then ssh) as a parameter, so the shell will expand it to your home directory rather than root's.

HOWEVER, I haven't tested this but I think the IdentityFile ~/.ssh/id_rsa entries in your config file will break, because they'll be resolved to root's ~/.ssh directory. You may need to give the explicit path to your home directory instead of the ~ shortcut. Another possibility would be to add -i ~/.ssh/id_rsa to the command line, so that again it'll be expanded by the shell running as you.

Also, you're likely to get warnings about unknown hosts etc because you'll be using root's ~/.ssh/known_hosts file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.