I have a machine called ic that I can ssh to. There is another machine, fw, that is on a completely different VLAN, and I cannot talk to it. ic is on both my VLAN and the VLAN that fw uses, and so my usual procedure for sshing to fw is to ssh into ic and from there ssh into fw. If I wanted to script this action, however, how could I get it to work?

I tried ssh root@ic "ssh root@fw", but this results in the message Pseudo-terminal will not be allocated because stdin is not a terminal, and then I get three messages from fw, presumably because it has null input:

Permission denied, please try again.
Permission denied, please try again.
Permission denied (publickey,password).

What's the best way to script this?


By default, ssh doesn't allocate a pty when a command is given. For interactive use, you can override this by using the -t option.

For authentication, if you are using public keys and a properly configured ssh-agent, you can use the -A option to enable agent forwarding.

ssh -t -A user@ic ssh root@fw

(What's it with using root everywhere? Don't be lazy, create an account.)

Another method, using TCP forwarding over SSH:

First establish a connection to ic with the -L (local tunnel) option:

ssh -L 7890:fw:22 -fN user@ic

Now all connections to localhost:7890 will be forwarded through ic to fw:22. (The port 7890 is arbitrary; you can pick any unused port you like.)

(The -fN options will make this connection keep running in background.)

Second, connect through the tunnel:

ssh root@localhost -p 7890
  • True, I don't need to be root on ic. Thanks! Jul 15 '11 at 9:53
  • Excellent answer. The local tunnel option allowed me to scp and git over a gateway, for which I continuously got the error messages in the question, and no other solution worked. Thanks!
    – Yuval
    May 25 '12 at 20:21
  • FWIW you can do the same with putty, which also uses the -t option. Feb 10 '13 at 23:48

Other method is using ProxyCommand:

ssh root@fw -o "ProxyCommand=ssh root@ic nc $FW_VLAN_IP %p"

This connects to ic, creates a netcat TCP proxy to fw and lends it to your local ssh client, which means that it will use your local authentication systems instead of the remote ones.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.