Hacker News Reader

Comment by dijit | Hacker News Reader

I'm looking at the man page, I had no idea about `-W`. However, what does this protect against that the standard:

    ProxyCommand ssh -q <jumpHost> nc %h 22

doesn't protect?

Edit: just tried `-W` as an addition to the line but I get

   littlefish :: ~ » ssh pgsql3
   Bad stdio forwarding specification '<jumpHost>'
   ssh_exchange_identification: Connection closed by remote host

View on HN

Try formatting it like this:

    ProxyCommand ssh jumpHost -W %h:%p

-W is essentially the same as using nc, however it doesn't require executing a command on the jumphost. This project uses that fact to make the jumphost more secure (you can't execute arbitrary commands), and do destination white-listing for each user.

sshmux gives fine-grained user controls. In the normal jumphost example, you can use ssh -W to connect to arbitrary ports and hosts on the network, poking around where you weren't intended (ssh -W is just netcat where the ssh server initiates the connection for you). With sshmux, ssh -W will only work to hosts permitted for that user, and any other request will just fail.

-W is just a nicer wait of doing your nc command

Reply on news.ycombinator.com