Review Suggested Edit

You can't approve or reject suggested edits because you haven't yet earned the Edit Posts ability.

Most importantly, `Proxyjump` is only a wrapper in the ssh to `ProxyCommand`. Essentially, `ProxyJump` does a portforwarding-only ssh session to the jumphost, and then executes the ssh session over this portforwarding.
~~It details are visible also in the detailed log (`-v -v -v`).~~
~~The cause of the mysterious `Connection closed by UNKNOWN port 65535` lies here: this error message is for port forwardings.~~
~~Thus, in this case, the parent ssh process can only see a pipe with what it is communicating, and not a socket. And a pipe has not a port number.~~
~~After tracking down the problem, I have found [sshconnect.c](https://github.com/openssh/openssh-portable/blob/master/sshconnect.c) in the openssh source code, where the troubles start.~~
~~The cause of the problem is that **the parent ssh process executes the forwarder to the ProxyJump in a shell.** Always in a shell, there is no way to turn it off.~~
~~In my opinion, it is not clear, why it must be done so, but so is it, and there is no way to turn it off with configuration settings.~~
Which shell is being used, that depends on the `SHELL` environment variable. If there is no such environment variable, then the ssh client will use a hardcoded default (most likely `/usr/bin/sh`).
However, system accounts like to have `/usr/bin/false` as shell, resulting the same as the shell environment variable. What will exit with an error without doing anything, without reporting back anything, independently from its parametrization.
The very simple solution is: **Although the system account might have /usr/bin/false as its shell variable, somehow it has to be set up, that the ssh client will use a valid shell.**
~~Simplest way is to give an `Environment=SHELL=/usr/bin/bash` setting in the system service file, if it is a systemd-based system.~~

Most importantly, `ProxyJump` in SSH is only a wrapper to `ProxyCommand`. Essentially, `ProxyJump` does a port-forwarding-only SSH session to the jump host and then executes the SSH session over this forwarded port.
Its details are visible in the detailed log (`-v -v -v`).
The cause of the mysterious `Connection closed by UNKNOWN port 65535` lies here: this error message is for port forwarding.
Thus in this case, the parent SSH process can only see a pipe with which it is communicating, not a socket. And a pipe does not have a port number.
After tracking down the problem, I have found [sshconnect.c](https://github.com/openssh/openssh-portable/blob/master/sshconnect.c) in the OpenSSH source code where the troubles start.
The cause of the problem is that **the parent SSH process executes the forwarder to the ProxyJump in a shell.** Always in a shell; there is no way to turn it off.
In my opinion, it is not clear why jumps must be done this way, but that's how they works, with no configuration settings to change it.
The shell being used depends on the `SHELL` environment variable. If there is no such environment variable, the SSH client will use a hardcoded default (most likely `/usr/bin/sh`).
However, system accounts like to have `/usr/bin/false` as their shells, resulting the same as the shell environment variable. Using `false` will exit with an error without doing anything, without reporting back anything, independently from its parameterization.
The very simple solution is: **Although the system account might have `/usr/bin/false` as its shell variable, somehow set it up for the SSH client to use a valid shell.**
The simplest way in a systemd-based system is to give an `Environment=SHELL=/usr/bin/bash` setting in the system service file.

Communities

Review Suggested Edit