Hacker News Reader

Comment by killbot5000 | Hacker News Reader

Don't forget easy ssh host hopping.

ssh -oProxyCommand="ssh host1 nc host2 22" host2

Interesting. Thanks for the tip! I'd never heard of ssh host hopping, but have been doing 2-3 sequential ssh logins for years. I always wondered if this was possible somehow! I found this nice tutorial that explains your tip in detail:

http://sshmenu.sourceforge.net/articles/transparent-mulithop...

This made all the time I've spent on HN in the past week worthwhile! :)

At $EMPLOYER, I have a script that takes a description of the network topology, converts it to a sequence of Host stanzas and writes them to ~/.ssh/config. The source file is simple enough that the sysad team can keep it up-to-date when they change the network configuration, and most people just have to run the 'update' script occasionally to have Super SSH Powers. It's quite popular.

Don't suppose you'd be willing to post this uber-script somewhere?

Unfortunately it's not really self-contained enough to post; the most complicated thing in it is basically a copy/paste of the "Dijkstra's Algorithm" sample-code on Wikipedia, though.

I used nc to do just this for years until I switched companies and found that many of the hosts didn't have nc installed.

To get around that I just added the following to my bashrc

alias remote_host="ssh -t bastion ssh -t host1 ssh host2"

Thanks for the tip, it inspired me to do the following:

user@host3# ssh-keygen -t rsa -f ~/.ssh/id_rsa_hopping

user@host3# echo command=\"nc host2 22\" `cat ~/.ssh/id_rsa_hopping.pub` | ssh user@host1 "cat >> ~/.ssh/authorized_keys"

user@host3# scp ~/.ssh/id_rsa_hopping* user@host4:~/.ssh/

The point of all of this being that host4 should be able to do anything on host2, but only be able to use host1 as a hop:

user@host4# ssh -oProxyCommand="ssh -i ~/.ssh/id_rsa_hopping host1" host2

Reply on news.ycombinator.com