Questions like How to remotely write to a file using SSH are about a direct SSH.

But I am reaching the end of a reverse tunnel which ends on intermediateserver. That is, I'm ssh'ing to one machine through another. And I want to write to a file on the distant machine. The following fails; it ends up writing on the intermediateserver!

ssh -A -t  intermediateserver ssh -A -t -p 666 localhost  "echo 30 > tmp"

The fact that there's a reverse ssh tunnel in there probably doesn't make things more complicated, so more generally, I am sitting on homeserver and going through intermediateserver to distantserver.

(In my case here, distant server appears to intermediate server internally on its port 666, due to a preexisting reverse tunnel) .

  • If you’re sshing from “intermediateserver” to localhost, then you’re still on “intermediateserver”.  Where are you connecting to a distant machine?  You say that the tunnel ends on “intermediateserver”, so what machine is more distant than the end of the line? Nov 2, 2018 at 5:47
  • I've edited for clarity. My situation is probably a bit more complex than relevant to the question.
    – CPBL
    Nov 2, 2018 at 16:09

1 Answer 1


For each hop, you'll need a layer of quoting. Essentially, ssh server some command foo bar ends up running $SHELL with the arguments -c and some command foo bar, so:

  1. The first layer of quotes is stripped by your local shell, where you ran the ssh command, and
  2. Each subsequent hop invokes a shell which strips another layer of quoting.

This in turn means that shell operations like variable expansion, redirection, wildcard expansion all need extra quoting to prevent intermediate shells from acting on them.

For example, if I had the files foo-a and foo-? in my home directory:

$ touch foo-a foo-\?
$ echo foo-*
foo-? foo-a
$ ssh Server1 echo foo-*
foo-? foo-a foo-a # foo-* expanded locally to foo-? foo-a, foo-? expanded again remotely
$ ssh Server1 'echo foo-*'
foo-? foo-a       # foo-* expanded remotely to foo-? foo-a
$ ssh Server2 ssh Server1 'echo foo-*'
foo-? foo-a foo-a # foo-* expanded remotely to foo-? foo-a, foo-? expanded again remotely in the next hop
$ ssh Server2 "ssh Server1 'echo foo-*'"
foo-? foo-a       # foo-* expanded in the last hop

It would be simpler if you used a ProxyCommand or ProxyHost. This will establish a tunnel between the two systems, instead of creating a baklava of shells executing commands:

~ ssh -o ProxyCommand='ssh Server2 nc %h %p' Server1 'echo foo-*'
foo-? foo-a

~ ssh -J Server2 Server1 'echo foo-*'
foo-? foo-a
  • I only know of two options for quoting things: ' and ". Can I re-use these, in an alternating way, for further layers? ie does the quote-unwrapping peel off the very end and very beginning? (Anyway I will try your better approach)
    – CPBL
    Nov 2, 2018 at 16:12
  • muru: Our code of conduct says “be nice”, not “be sweet”.  What does baklava have to do with this?   :-)   ⁠ Nov 2, 2018 at 18:23
  • @CPBL unfortunately, no. "l1 'l2 "l3 'l4' 3" 2' 1" is seen by the first shell as three strings: l1 'l2 l3, l4, 3 2' 1. It might be possible to get up to three layers of quoting by using backslashes as well, but that way leads to insanity.
    – muru
    Nov 2, 2018 at 19:06
  • @Scott reminded me of something I saw on Jeff Atwood's blog a while ago: See #14 in blog.codinghorror.com/new-programming-jargon
    – muru
    Nov 2, 2018 at 19:07
  • Any chance you could provide the ProxyCommand example using my situation in which the destination is a port on the intermediate? I am still stuck interpreting these cryptic bits
    – CPBL
    Nov 3, 2018 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.