1

Let's say there are 3 computers A B and C. B and C are remote computers but in the same local network.

I SSH into computer B from computer A. Is it now possible to ssh into C from B?

1
  • it's called a SSH multi-hop and the same can be accomplished via a bastion server
    – JW0914
    Jul 23 '20 at 10:30
2

It is entirely possible. Not only that but there are ways to automate this process within SSH (more then 1 in fact).

Many "secure" systems use this approach where server C only trust server B, and everyone needs to SSH through it. The name for this kind of host is called a bastion.

  • As mentioned, you can SSH to B, then from B you can SSH to C.

You can also set up B to authenticate and forward a connection to C without even getting a shell on B - either by using SSH forwarding or by having SSHon B recognise the log in and immediately log in to C.

5
  • Although they accomplish the same end goal, a SSH multi-hop and Bastion [server] setup are two completely different things.
    – JW0914
    Jul 23 '20 at 10:33
  • @jw0914 - I acknowledge that multihop ssh and bastions are not synoyms, but disagree they are completely different - especially as I said SSH through, not to it - but please explain how you see it. (Support for my interpretation - learningjournal.guru/article/public-cloud-infrastructure/… en.m.wikipedia.org/wiki/Bastion_host cloudacademy.com/blog/… )
    – davidgo
    Jul 23 '20 at 11:11
  • Generally when "bastion" is used, it's used in the context of a dedicated Bastion Server for Bastion Hosts. For example, I run Sophos UTM on a custom-built router & to SSH into any downstream devices, I must do a SSH multi-hop, however that doesn't make my router a Bastion Server, as a Bastion Server is a specific thing that must be configured, else we'd call every SSH server a Bastion Server. A sentence in the Cloud Academy AWS blog provides more context: "When designing the bastion host [server] ... you shouldn’t use it for any other purpose, as this could open unnecessary security holes".
    – JW0914
    Jul 23 '20 at 11:45
  • @jw0914 In that case we agree on what a Bastion is.
    – davidgo
    Jul 23 '20 at 20:37
  • Your comment in regards to the context of what you're disputing makes no sense.
    – JW0914
    Jul 23 '20 at 22:49
1

Yes, this is not only possible but also quite common, and therefore a supported use case; the correct search terms for this are bastion host, jump host, or ssh proxy.

  • The best way is to use the ProxyJump option of ssh, specified with the -J flag, which will establish a connection to hostC through hostB:
    # on host A
    ssh -J userB@hostB userC@hostC
    
  • A more flexible option is the ProxyCommand option, which can use any command to connect to the target host using stdin/stdout of the command:
    ssh -o ProxyCommand "ssh userB@hostB -W %h:%p" userC@hostC
    
    This will first start a second ssh client connecting to hostB and -W will connect its stdin/stdout to hostC [%h] on the ssh port [%p].
  • For more convenience, you can specify all these options in your .ssh/config, allowing you to connect with just ssh hostC:
    Host hostC
      User userC
      ProxyJump userB@HostB
      # alternatively using ProxyCommand:
      #ProxyCommand ssh -W %h:%p userB@hostB
    

If for some reason both ProxyJump and ProxyCommand/ssh -W %h:%p are not available to you, you could setup tunneled port forwarding yourself:

# start a ssh process in the background to forward
# from localhost (host A) port 2222 to port 22 on hostC from hostB
ssh -f -N -L localhost:2222:hostC:22 userB@hostB

# connect to localhost:2222 which is tunneled to hostC:22
ssh -p 2222 userC@localhost
5
  • A Bastion server is not the same thing as a SSH proxy/SSH multi-hop, even though they accomplish the exact same thing: generally, when "Bastion" is used, it's used in the context of a dedicated Bastion server. For example, I run Sophos UTM on a custom-built router and to SSH into any downstream devices, I must do a SSH multi-hop; however, that doesn't make my router a Bastion server, as a Bastion server is a specific thing that must be configured, else we'd call every SSH server a Bastion server. Bastion servers are usually secured in their own environment, with no other purpose, for security.
    – JW0914
    Jul 26 '20 at 14:13
  • Ultimately the OP wants "to ssh into C from B". Your ssh -J userB@hostB userC@hostC does not ssh from B. See the analysis in this answer. The difference may not matter for the OP; but in general, in some circumstances it may matter. Jul 26 '20 at 18:59
  • @KamilMaciorowski correct: with this will ultimately establish a direct ssh connection between host A and host C but tunneled through another ssh connection to host B. This will not involve the ssh client on host B; which is what I understood @vahagn-tumanyan wanting to achieve. Otherwise if the connection should be made from host B it's indeed something completely different but also even simpler: just ssh userB@hostB ssh userC@hostC
    – acran
    Jul 26 '20 at 21:49
  • @KamilMaciorowski While I interpreted the OP's question the same way as acran, your interpretation is equally valid as it depends upon which way you read it.
    – JW0914
    Jul 27 '20 at 4:03
  • @acran Just an FYI, the line you thought was dropped in the edit is still there, it was just combined into the originating sentence for grammatical correctness, as breaking a sentence before and after a code box leaves it discombobulated: "For more convenience, you can specify all these options in your .ssh/config, allowing you to connect with just ssh hostC"
    – JW0914
    Jul 27 '20 at 11:55
-1

Well, if system B can reach system C via tcp port 22 and there is an SSH daemon running on C where you have a valid user for - yes!

5
  • This is a comment, not an answer...
    – JW0914
    Jul 23 '20 at 10:30
  • 1
    It is an answer - see the last word.
    – fratester
    Jul 23 '20 at 10:46
  • You have a fundamental misunderstanding of what constitutes an answer... please see How do I write a good answer? and Why and how are some answers deleted?. Leaving this answer as is will result in an accumulation of down votes as more come across.
    – JW0914
    Jul 23 '20 at 11:14
  • @jw0914 I think these ARE valid answers and certainly fit within the guidelines you linked to. The question is simple enough that it demands no more then a yes or no in response. I'm genuinely surprised the answers were down voted to -2. ( I upvoted them back to -1)
    – davidgo
    Jul 23 '20 at 20:44
  • @davidgo A yes/no statement isn't really an answer in the context of StackExchange (I've never come across upvoted answers with a simple yes or no statement as the entire answer; perhaps you have?), as it lacks either an explanation or how to perform a multi-hop, either of which was my interpretation of the intent of the OP's question (then again, it could be I simply have a high bar for answers). As currently written, this answer would be better served as a comment, however if the author chooses to take the time to flesh out this answer, I'll remove my downvote and would likely upvote it.
    – JW0914
    Jul 24 '20 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.