Use ProxyCommand for all SSH Connections

I was playing around with the idea of having a SSH Proxy Server or otherwise called Jump Host, which I would use to connect to all of my "hidden" Servers. So basically I have the following setup. Please note I intentionally use IP addresses here instead of hostname.

<client> ---> <proxy_ssh> ---> <192.168.0.*>

My intention is that it should be as transparent for the users as possible. So ideally the users should only have to execute the following command

# ssh user@192.168.0.10

To get this working I've created the following .ssh/config.

Host *                                                                                                                                                                           
    ServerAliveInterval 240                                                                                                                                                      
    Compression yes                                                                                                                                                              
    ForwardAgent yes                                                                                                                                                             
    ForwardX11 yes                                                                                                                                                               

Host 192.168.0.*                                                                                                                                                                   
    ProxyCommand ssh my_user@proxy_ssh.example.com netcat -w 120 %h %p

This works fine. But it is kind of tedious if I would have more networks to work with behind my proxy_ssh server. So I've tried simply adding the ProxyCommand to the Host * section which did not work.

I've wanted to make this more transparent for the end user, and changed the ssh config to the following, simply leaving out the specific Host definition.

Host *
    ServerAliveInterval 240                                                                                                                                                      
    Compression yes                                                                                                                                                              
    ForwardAgent yes                                                                                                                                                             
    ForwardX11 yes                                                                                                                                                               
    ProxyCommand ssh my_user@proxy_ssh.example.com netcat -w 120 %h %p

This had the impact that I was not able to connect any longer to the endhost. The connection simply timed out!

So hence my question is there any way of having this more transparent in such a way that all of my SSH connection would use the proxy_ssh host?

latz

Posted 2017-01-30T12:18:08.177

Reputation: 133

which did not work. ... what errors you get? How the configuration looked like? – Jakuje – 2017-01-30T13:20:13.023

Added the example I've actually tried – latz – 2017-01-30T13:24:01.353

The example above will make it recursive, that every connection will use a proxy command, which is ssh with just another proxy commmand. Good way to DOS your proxy. You should exclude the proxy from the list or use -F /dev/null to ignore the configuration for the proxy command. – Jakuje – 2017-01-30T13:29:32.340

By specifying -F /dev/null I will overwrite the config all together If I understand the man page correctly. That's not what I want. – latz – 2017-01-30T13:34:09.460

Only in the ProxyCommand ssh. The other possibility is to overwrite only the ProxyCommand using -oProxyCommand=none. – Jakuje – 2017-01-30T13:36:26.500

Ok Perfect that works like a charm. So I've edited the line ProxyCommand .ssh/config to the following ProxyCommand ssh -oProxyCommand=none my_user@proxy_ssh.example.com netcat -w 120 %h %p . So in fact you can post exactly that as answer :) – latz – 2017-01-30T13:42:12.177

More importantly, if you have these sort of wildcard configurations, have them appear later in your .config, after the more specific entries. According to https://man.openbsd.org/OpenBSD-current/man5/ssh_config.5 the first encountered value for a specific value is the one used, so a later "override" will be ignored.

– devstuff – 2017-09-21T19:07:05.663

Use ProxyCommand for all SSH Connections

Answers