I want to setup a bastion for SSH and tunneling HTTP :

  • let the user use a private key stored on bastion without having read access to it
  • permit the use of proxyjump (or proxycommand) on the client

Use case :

  • Client (employe)
  • Bastion (own private key)
  • ServerA, ServerB, ServerC, ... (authorize bastion key)

I want the client to connect to serve A like this :

Client ==[ldap]==> bastion ==[keys]==> serverA

I manage to do it with sudo on bastion:

# allow users to use bastion keys
%users ALL=(bastion) NOPASSWD: /usr/bin/ssh

Then to connect I use, from client (with a user in users group):

alias ssh-bastion="ssh -t myuser@bastion 'sudo -u bastion /usr/bin/ssh'" 
ssh-bastion serverA

For authentification, it works fine.
For tunneling, it's a bit more complicated to have ssh-bastion -L8080:localhost:8080 to work.
And for ansible, I haven't manage to make it work...

Is there a way to configure something like this in .ssh/config of the client ?

Host serverA
    ProxyCommand ssh bastion -W %h:%p sudo -u bastion /usr/bin/ssh
    Port          22
    User          myuser

Note : It's not possible for the user to own the private key.

1 Answer 1


I think you're looking for:

ProxyCommand ssh bastion sudo -u bastion /usr/bin/ssh -W %h:%p

It's not a very good idea to use sudo ssh. There are a few ways to make the 'ssh' program cough up the contents of any file it has access to – e.g. through LocalCommand, or PKCS11Provider, or ProxyCommand, or Include, or SecurityKeyProvider... Stealing /home/bastion/.ssh/id_rsa is easy given access to any of those options.

Well, at least sudo makes sure all of that gets logged.

(Instead, I would probably use ssh-agent. Compile a customized version with the "peeruid" check removed so that it allows any UID to connect to the agent socket. Then run the custom agent under the 'bastion' user and load keys into it. Now set SSH_AUTH_SOCK=/tmp/shared-agent and you can connect using the key without having any access to the actual key.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.