I'm wanting to try and set up an easy way to manage my SSH proxy settings. I find I often want to SSH to my server from three different locations - two locations each have their own proxy server which I need to use corkscrew in order to get to the outside world, and one which doesn't have a proxy server at all. Is there a way that I can set up my ~/.ssh/config file to recognise which ProxyCommand to use? The reason I'd like to do this is that I want to set up Fetchmail to tunnel through my server over SSH (using crontab), and I can't figure out how to make this work no matter which network I'm on.



You can do per-host configuration in your .ssh/config:

Host ex1
HostName proxied.example.com
User myuser
ProxyCommand /usr/local/bin/corkscrew proxy.example.com 8080 %h %p

Host ex2
HostName nonproxy.example.com
User myuser
IdentityFile id_rsa


ssh ex1

would ssh to proxied.example.com and invoke the corkscrew proxy, and

ssh ex2

would ssh to nonproxy.example.com and use the identity file from your .ssh folder.

Automatic Detection

What the corkscrew proxy does it creates a connection through the local proxy, and accepts input on standard-in for ssh to connect through. You can use anything as a ProxyCommand provided it connects to the remote ssh server somehow, and accepts input on standard in.

For example, you could use netcat to establish the connection to the remote host and ssh would talk to netcat via standard-in:

ProxyCommand nc %h %p

When you ssh to a server with this proxy command, ssh would invoke nc to make the tcp connection to the remote host on port 22 then ssh would send its commands through the standard-in of nc.

This would serve no purpose, having nc establish the tcp session instead of ssh doesn't give you anything. Except you could create a wrapper script called "proxytest" for example, that did a test to see if a direct connection could be established using nc, and and otherwise tried to use corkscrew - something like:

if nc -z $1 $2; then
   exec nc $1 $2  # try to connect directly
   exec corkscrew $3 $4 $1 $2  # set up proxy connection

So if either of these work, then there will be a standard-in available that ssh can use to connect - either by the one from netcat or the one from corkscrew. So your ssh config would have:

ProxyCommand proxytest %h %p proxy.example.com 8080

There is a ready made script here that you may want to try out, with proper tests and error checking. Scroll down to the "Other Tricks" section.

  • Ok, but what if I'm SSHing to the same host each time, just through different proxies? How do I automate that so it can detect automatically which network I'm on? I've already got the ProxyCommand and host aliasing set up so I can just go 'ssh server' and up it comes, but I want this to be automatic so it can be scripted. I'm not sure if what I'm looking to do is possible. – NOP Jan 17 '12 at 23:53
  • 1
    Could you use Host ex3 pointing to the same destination as Host ex2 but without the ProxyCommand entry? I realise this isn't automatic. – Paul Jan 18 '12 at 0:07
  • Yeah, that's what I've got already. The automatic thing is more what I want so it's able to be scripted in conjunction with Fetchmail. – NOP Jan 18 '12 at 0:12
  • 1
    Oops, I see. I have updated my answer with the automatic part I missed. – Paul Jan 18 '12 at 0:41
  • Awesome, that sounds like what I want. I'll give this a go. Thanks so much. :-) – NOP Jan 18 '12 at 0:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.