I need to have a group of users hop through a server ('bastion') into another machine ('dest') via ssh to commit code.

Seems like my options are:

  1. tell users to use ProxyCommand in their .ssh/config file, something like:

    Host dest
    ProxyCommand ssh -q bastion nc -q0 dest 22

  2. use ForceCommand in the sshd config file, like

    Match Group hopUsers
    ForceCommand ssh dest $SSH_ORIGINAL_COMMAND

  3. use the command option in the .ssh/authorized_keys users' file, like

    command="ssh dest"

The first solution is great, it works with mercual commits, etc. -- The problem is that I don't want to give my users a valid shell on the bastion machine. I could set their login shell to /bin/false, but this leaves a whole set of issues unattended (see here) -- unless perhaps coupled with a dedicated set of options (like noX11Forwarding) in the sshd config file, within a Match stanza.

The problem with the second and third solution is that public key authentication is 'lost', i.e. unless the client uses the -A option when launching ssh, the server will respond with:

debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: .ssh/XXXXXX
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LC_ALL = en_US.UTF-8
debug1: Sending env LANG = en_US.UTF-8

Hence requesting the user password. This is not acceptable.

I think there is something that can be done with nc in proxy mode, but I can't seem to get it to work.

Any help would be greatly appreciated.

1 Answer 1


The solution turned out to be:

On the client side, in .ssh/config:

Host dest
    ProxyCommand ssh -q bastion

On the server side, in sshd_config:

Match Group hopUsers
        ForceCommand nc -q0 dest port

The users' authorized_keys on the server does not need any command=.

Now if a user tries to do anything else (e.g. launches ssh without the ProxyCommand) all they get is netcat's output

$ ssh user@bastion
SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1.2

Thanks to the folks of #openssh on freenode.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.