12

I need to establish a connection to a remote server via proxy jump. I'm trying to use the -J flag to do that. I understand that the syntax looks like this:

ssh -J A B

But I need to use key files for both connections. So I've tried this:

ssh -J -i /path/proxy.pem user@proxy_host -i /path/target.pem user@target_host

Obviously it's not working, I'm getting

option requires an argument -- i
usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]
           [-D [bind_address:]port] [-E log_file] [-e escape_char]
           [-F configfile] [-I pkcs11] [-i identity_file]
           [-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]
           [-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]
           [-S ctl_path] [-W host:port] [-w local_tun[:remote_tun]]
           [user@]hostname [command]
ssh_exchange_identification: Connection closed by remote host

What is the correct inline syntax in this case, without editing ssh settings? In this case there is no difference which server the keys are stored on.

1 Answer 1

12

I understand that the syntax looks like this:

ssh -J A B

Yes, but that's not the whole story. -J is not a standalone flag – it doesn't simply let you specify two independent sets of connection options in the same command line, as you're trying to do.

Instead, the -J flag takes the intermediate host's name as a parameter, so just like -i <keyfile> always go together, -J <proxy> must also remain together.

And even if you use this option, the overall 'ssh' syntax doesn't change – there's still no grouping of which options belong to host A and which belong to host B. If you have two '-i' options like that, SSH will just try both keys when making each of the two connections.

The latter part shouldn't be a problem, however, as each server will just indicate that it doesn't accept the key and SSH will try another. So the following should work:

ssh -J user@proxy_host -i /path/proxy.pem -i /path/target.pem user@target_host
    └────────────────┘ └────────────────┘ └─────────────────┘

But if one of the hosts doesn't like the fact that multiple keys are being tried, you will need to translate the -J into long-form ProxyCommand:

ssh -o ProxyCommand="ssh -i /path/proxy.pem -W %h:%p user@proxy_host" -i /path/target.pem user@target_host
5
  • 2
    Your first solution didn't work, because the first key is just ignored, but the second solution works just fine, so thanks.
    – Caballero
    Commented Mar 23, 2020 at 16:18
  • The documentation says that multiple -i options are allowed and get combined into a list – so it should work as long as each server only accepts the correct key, unless the docs are wrong. (But I can see situations where it wouldn't work, e.g. if proxy_host was configured by an asshole and is accepting the "target.pem" key just to immediately kick you off afterwards.) Commented Mar 23, 2020 at 16:20
  • 1
    With the first example I'm getting Permission denied (publickey). which is what normally happens when key is not included or key is wrong. The proxy_host configuration is out of the box default Ubuntu 18.04 install, I control the server. In any case, so long as the second way is working I'm fine. Thanks.
    – Caballero
    Commented Mar 23, 2020 at 16:52
  • Another option is to set up your ssh config file with IdentityFile entries for the two hosts (see the second example here, and the right ones will be used automatically. You could even add ProxyJump proxy_host to the section for target_host (and a User entry in the proxy_host section), and it'll automate the jump step entirely. Commented Mar 23, 2020 at 17:27
  • Yes, but OP did specifically ask "without editing ssh settings". Commented Mar 23, 2020 at 17:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .