Using the SSH ProxyCommand directive in the client ~/.ssh/config file it is possible to connect to a SSH server through a different SSH server acting as a jump host.

Is there a similar configuration for the SSH server side? E.g., when the user logs on to a jump machine with a certain authorized key, I want this SSH connection to be automatically forwarded to another machine also running sshd.


You can specify a command that is executed whenever someone logs in using a ssh key.

Edit the file ~/.ssh/authorized_keys. Prepend every key you want to forward with a command=ssh user@target.

This has to be done for every user. Since this is done using a user configuration file, every user may change this. If you trust your users (or you are the only user) then this is ok. You can also prevent users from changing this by not giving them any other means to access the shell on this machine.

For more information read the sshd man page. Search for the AUTHORIZED_KEYS FILE FORMAT section, and then for command="command".

Alternatively: you can force a command using a ForceCommand in /etc/ssh/sshd_config. This option is more secure as it is enforced by sshd, and only users with root privileges can change that.

For more information read the sshd_config man page. Search for ForceCommand.

|improve this answer|||||
  • authorized_keys file isn't exatcly the same as the ssh config file, since commands like rsync and scp don't work with ssh redirect in authorized_keys. Do you know how one might get that working too? – zidarsk8 Mar 20 '14 at 10:54
  • i am sorry i cannot help you with that anymore. my ssh days are long behind and i am no longer in deep knowledge of the arcane intricacies of ssh. maybe this will help you: superuser.com/questions/276533/scp-files-via-intermediate-host – lesmana Apr 24 '18 at 7:31

The easiest way would just be to have

ssh -t user@host

in the user's .bash_login file so that when they log in it just starts a new ssh session to the remote machine. (The -t forces pseudo-tty allocation - not sure if you need this or not)

If you want to get more complex / centrally managed, you could replace the user's shell with a script/program that selects the correct remote server to connect to and execute the ssh command accordingly.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.