Post History
Canina's answer contains a good solution if you only want to reach a small number of hosts. But requiring a port[1] for each host you want to reach doesn't scale to many hosts. It also requires yo...
Answer
#2: Post edited
by
Michael
·
2024-05-07T09:10:13Z (7 months ago)
Link Canina. Move some parentheticals to footnotes. Minor grammar improvements.
@Canina's answer contains a good solution if you only want to reach a small number of hosts.But requiring a port (local though, not on the jumphost, so many users don't compete for resources) for each host you want to reach doesn't scale to many hosts. It also requires you set the tunnel up before you need it, that's not good if you don't know which hosts you'll need to connect to.In an earlier setup at the company I work for, we had a bunch of hosts (and it constantly grew) I could only reach through a jumphost, to reach them I had a line like the following in my `.ssh/config` for a wildcard entry matching the hosts I couldn't reach directly:- ProxyCommand ssh <myuser>@<jumphost> nc -w1 %h %p
This made ssh (I am - and also was back then - on a linux machine, using the openssh implementation) connect to the jumphost and on that run `nc` which then proxied everything to the host I really wanted to connect to. I don't remember, but this probably required me to run an SSH-agent with forwarding enabled.
- [Canina's answer][canina] contains a good solution if you only want to reach a small number of hosts.
- But requiring a port[^localport] for each host you want to reach doesn't scale to many hosts. It also requires you set the tunnel up before you need it. That's not good if you don't know which hosts you'll need to connect to.
- In an earlier setup at the company I work for, we had a bunch of hosts I could only reach through a jumphost, and the list constantly grew. To reach them, I had a line like the following in my `.ssh/config` for a wildcard entry matching the hosts I couldn't reach directly:
- ProxyCommand ssh <myuser>@<jumphost> nc -w1 %h %p
- This made SSH[^openssh] connect to the jumphost and run `nc` on it, which then proxied everything to the host I really wanted to connect to. I don't remember, but this probably required me to run an SSH-agent with forwarding enabled.
- [^localport]: A local port, not one on the jumphost, so many users don't compete for resources.
- [^openssh]: I am—and also was back then—on a Linux machine, using the OpenSSH implementation.
- [canina]: https://linux.codidact.com/posts/282493/282494#answer-282494
#1: Initial revision
by
Grove
·
2021-07-03T21:24:07Z (over 3 years ago)
@Canina's answer contains a good solution if you only want to reach a small number of hosts.
But requiring a port (local though, not on the jumphost, so many users don't compete for resources) for each host you want to reach doesn't scale to many hosts. It also requires you set the tunnel up before you need it, that's not good if you don't know which hosts you'll need to connect to.
In an earlier setup at the company I work for, we had a bunch of hosts (and it constantly grew) I could only reach through a jumphost, to reach them I had a line like the following in my `.ssh/config` for a wildcard entry matching the hosts I couldn't reach directly:
ProxyCommand ssh <myuser>@<jumphost> nc -w1 %h %p
This made ssh (I am - and also was back then - on a linux machine, using the openssh implementation) connect to the jumphost and on that run `nc` which then proxied everything to the host I really wanted to connect to. I don't remember, but this probably required me to run an SSH-agent with forwarding enabled.