ssh to a remote server via gateway server

[L]

Hi,
I routinely login a remote server via a 'gateway' machine. For example, I
need to login to PC B using ssh. But this PC B is behind a firewall.ssh port
on PC A is open.

As a result, I have to login  PC A via ssh, then ssh PC B from PC A.

Is there ssh command line option that I can directly ssh to PC B?

Thanks
Y

[L]

On Mon, Jun 2, 2008 at 4:38 PM, Cameron Simpson <cs(a)zip.com.au&gt; wrote:

>  On 02Jun2008 16:23, lux <yuanlux(a)gmail.com&gt; wrote:
>  | > >> I have a script called "sshto" that does exactly this for
> multihop
>  ssh
>  | > >> connections. Very handy, especially since you can make "sshto"
> the
>  | > >> default transport for rsync, letting you do multihop rsyncs easily:
>  | > >>
>  | > >>   rsync some-dir/ host1\!host2\!host3:some-other-dir/
>  | > >
>  | > > It sounds like you have experience with what he is trying to do, so
>  | > > please continue to advice the OP. What he is does now is ssh to PC A,
>  and
>  | > > then ssh to PC B. What he wants to ssh to PC B in one command, but he
>  has
>  | > > to go through PC A. (firewall machine?)
>  | >
>  | > Then he definitely wants sshto:
>  | >
>  | >  http://www.cskk.ezoshosting.com/cs/css/bin/sshto
>  | >
>  | > Conveniently, it can make use of an sshtorc file that maps "name" into
>  an
>  | > arbitrary "name1!name2!name3!..." ssh hop path. I routiney get only
>  | > certain hosts as "sshto foo" where "foo" designates a multihop
> ssh
>  path.
>  |
>  | Sounds a  very interesting tool. I gave it a try. But
>  | what is shqstr?
>  | looks a like a command, but not in my system
>
>  Yeah, sshto shamelessly uses other scripts from that same collection.
>  Shqstr quotes strings for handing to eval/sh/remote-ssh intact.
>
>  The simplest thing is to go to:
>    http://www.cskk.ezoshosting.com/cs/css/
>  and download the tarball, unpack into /opt/css. Source /opt/css/env.sh
>  to fix up your $PATH (it appends, so as not to preempt any of your
>  normal commands or libraries). Then retry.
>
>  Please let me know if you have further trouble; this stuff is _meant_ to be
>  usable by people who aren't me:-)
>
>  Cheers,
>  
Thanks a lot, I will try it. I followed your hint of ProxyCommand

here is the .ssh/config file:

Host labpc
        ProxyCommand ssh  lux@gw -t -w 3 labpc 22

When

ssh labpc

I got two layers of prompt for login. there were possible outputs:

1st, sometime, I got login to labpc , but it last 1 or 2 seconds, and get
discconetctd with this message:Connection to labpc closed by remote host.

the 2nd output is failure to login and got this message:
Write failed: Broken pipe

any suggest? thanks

Y





>  --
>  Cameron Simpson <cs(a)zip.com.au&gt; DoD#743
>  http://www.cskk.ezoshosting.com/cs/
>
>  When Microsoft Office is your only hammer, pretty much everything begins to
>  look like a nail. Or a thumb. - Rob Pegoraro
>
>  --
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>

[Cameron Simpson]

On 02Jun2008 16:23, lux <yuanlux(a)gmail.com&gt; wrote:
| > >> I have a script called "sshto" that does exactly this for
multihop ssh
| > >> connections. Very handy, especially since you can make "sshto"
the
| > >> default transport for rsync, letting you do multihop rsyncs easily:
| > >>
| > >>   rsync some-dir/ host1\!host2\!host3:some-other-dir/
| > >
| > > It sounds like you have experience with what he is trying to do, so
| > > please continue to advice the OP. What he is does now is ssh to PC A, and
| > > then ssh to PC B. What he wants to ssh to PC B in one command, but he has
| > > to go through PC A. (firewall machine?)
| >
| > Then he definitely wants sshto:
| >
| >  http://www.cskk.ezoshosting.com/cs/css/bin/sshto
| >
| > Conveniently, it can make use of an sshtorc file that maps "name" into
an
| > arbitrary "name1!name2!name3!..." ssh hop path. I routiney get only
| > certain hosts as "sshto foo" where "foo" designates a multihop
ssh path.
| 
| Sounds a  very interesting tool. I gave it a try. But
| what is shqstr?
| looks a like a command, but not in my system

Yeah, sshto shamelessly uses other scripts from that same collection.
Shqstr quotes strings for handing to eval/sh/remote-ssh intact.

The simplest thing is to go to:
  http://www.cskk.ezoshosting.com/cs/css/
and download the tarball, unpack into /opt/css. Source /opt/css/env.sh
to fix up your $PATH (it appends, so as not to preempt any of your
normal commands or libraries). Then retry.

Please let me know if you have further trouble; this stuff is _meant_ to be
usable by people who aren't me:-)

Cheers,
-- 
Cameron Simpson <cs(a)zip.com.au&gt; DoD#743
http://www.cskk.ezoshosting.com/cs/

When Microsoft Office is your only hammer, pretty much everything begins to
look like a nail. Or a thumb. - Rob Pegoraro

[L]

On Sat, May 31, 2008 at 1:57 PM, Cameron Simpson <cs(a)zip.com.au&gt; wrote:

>  On 30May2008 19:14, Mikkel L. Ellertson
> <mikkel(a)infinity-ltd.com&gt; wrote:
>  > Cameron Simpson wrote:
>  >> I missed the start of this thread, but you can use the ProxyCommand ssh
>  >> option to hop through multiple servers, keeping the "top level" ssh
>  >> nicely connected to your terminal and the endpoint (via the proxycommand
>  >> tunnel). Which may solve the -t option issue.
>  >>
>  >> I have a script called "sshto" that does exactly this for multihop
> ssh
>  >> connections. Very handy, especially since you can make "sshto" the
>  >> default transport for rsync, letting you do multihop rsyncs easily:
>  >>
>  >>   rsync some-dir/ host1\!host2\!host3:some-other-dir/
>  >
>  > It sounds like you have experience with what he is trying to do, so
>  > please continue to advice the OP. What he is does now is ssh to PC A, and
>  > then ssh to PC B. What he wants to ssh to PC B in one command, but he has
>  > to go through PC A. (firewall machine?)
>
>  Then he definitely wants sshto:
>
>   http://www.cskk.ezoshosting.com/cs/css/bin/sshto
>
>  Conveniently, it can make use of an sshtorc file that maps "name" into an
>  arbitrary "name1!name2!name3!..." ssh hop path. I routiney get only
>  certain hosts as "sshto foo" where "foo" designates a multihop ssh
> path.
>  

Sounds a  very interesting tool. I gave it a try. But

what is shqstr?
looks a like a command, but not in my system

thanks

>  Cheers,
>  --
>  Cameron Simpson <cs(a)zip.com.au&gt; DoD#743
>  http://www.cskk.ezoshosting.com/cs/
>
>  My motto is, 'Do it my way or watch your butt.' -  Nathan Arizona
>
>  --
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>

[Patrick O'Callaghan]

On Sat, 2008-05-31 at 13:58 +1000, Cameron Simpson wrote:
>  On 31May2008 13:57, I wrote:
>  | Conveniently, it can make use of an sshtorc file that maps "name" into an
>  | arbitrary "name1!name2!name3!..." ssh hop path. I routiney get only
>  | certain hosts as "sshto foo" where "foo" designates a multihop ssh
> path.
>  
>  s/only/onto/
>  
>  Whoops. 
s/Whoops/Oops/

:-)

poc

[Cameron Simpson]

On 31May2008 13:57, I wrote:
| Conveniently, it can make use of an sshtorc file that maps "name" into an
| arbitrary "name1!name2!name3!..." ssh hop path. I routiney get only
| certain hosts as "sshto foo" where "foo" designates a multihop ssh
path.

s/only/onto/

Whoops.
-- 
Cameron Simpson <cs(a)zip.com.au&gt; DoD#743
http://www.cskk.ezoshosting.com/cs/

NFS: Not a File System

[Cameron Simpson]

On 30May2008 19:14, Mikkel L. Ellertson <mikkel(a)infinity-ltd.com&gt; wrote:
>  Cameron Simpson wrote:
> > I missed the start of this thread, but you can use the ProxyCommand ssh
> > option to hop through multiple servers, keeping the "top level" ssh
> > nicely connected to your terminal and the endpoint (via the proxycommand
> > tunnel). Which may solve the -t option issue.
> >
> > I have a script called "sshto" that does exactly this for multihop ssh
> > connections. Very handy, especially since you can make "sshto" the
> > default transport for rsync, letting you do multihop rsyncs easily:
> >
> >   rsync some-dir/ host1\!host2\!host3:some-other-dir/
>
>  It sounds like you have experience with what he is trying to do, so  
>  please continue to advice the OP. What he is does now is ssh to PC A, and 
>  then ssh to PC B. What he wants to ssh to PC B in one command, but he has 
>  to go through PC A. (firewall machine?) 
Then he definitely wants sshto:

  http://www.cskk.ezoshosting.com/cs/css/bin/sshto

Conveniently, it can make use of an sshtorc file that maps "name" into an
arbitrary "name1!name2!name3!..." ssh hop path. I routiney get only
certain hosts as "sshto foo" where "foo" designates a multihop ssh
path.

Cheers,
-- 
Cameron Simpson <cs(a)zip.com.au&gt; DoD#743
http://www.cskk.ezoshosting.com/cs/

My motto is, 'Do it my way or watch your butt.' -  Nathan Arizona

[Mikkel]

Cameron Simpson wrote:
>  On 30May2008 08:31, Mikkel L. Ellertson
> <mikkel(a)infinity-ltd.com&gt; wrote:
> > lux wrote:
> >> I'm not sure that Mikkel's solution will work:
> >> "Pseudo-terminal will not be allocated because stdin is not a
> terminal"
> >> will be the error message.
> >>
> > You can try adding the -t option to the command to run on PC A.
>  
>  I missed the start of this thread, but you can use the ProxyCommand ssh
>  option to hop through multiple servers, keeping the "top level" ssh
>  nicely connected to your terminal and the endpoint (via the proxycommand
>  tunnel). Which may solve the -t option issue.
>  
>  I have a script called "sshto" that does exactly this for multihop ssh
>  connections. Very handy, especially since you can make "sshto" the
>  default transport for rsync, letting you do multihop rsyncs easily:
>  
>    rsync some-dir/ host1\!host2\!host3:some-other-dir/
>  
>  (You will need the \! on the command prompt line instead of plain ! to
>  avoid your shell's history substitution syntax - a shell script does
>  not need the annoying sloshes).
>  
>  Cheers, 
It sounds like you have experience with what he is trying to do, so 
please continue to advice the OP. What he is does now is ssh to PC 
A, and then ssh to PC B. What he wants to ssh to PC B in one 
command, but he has to go through PC A. (firewall machine?)

Mikkel
-- 

   Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Cameron Simpson]

On 30May2008 08:31, Mikkel L. Ellertson <mikkel(a)infinity-ltd.com&gt; wrote:
>  lux wrote:
> > I'm not sure that Mikkel's solution will work:
> > "Pseudo-terminal will not be allocated because stdin is not a terminal"
> > will be the error message.
> >
>  You can try adding the -t option to the command to run on PC A. 
I missed the start of this thread, but you can use the ProxyCommand ssh
option to hop through multiple servers, keeping the "top level" ssh
nicely connected to your terminal and the endpoint (via the proxycommand
tunnel). Which may solve the -t option issue.

I have a script called "sshto" that does exactly this for multihop ssh
connections. Very handy, especially since you can make "sshto" the
default transport for rsync, letting you do multihop rsyncs easily:

  rsync some-dir/ host1\!host2\!host3:some-other-dir/

(You will need the \! on the command prompt line instead of plain ! to
avoid your shell's history substitution syntax - a shell script does
not need the annoying sloshes).

Cheers,
-- 
Cameron Simpson <cs(a)zip.com.au&gt; DoD#743
http://www.cskk.ezoshosting.com/cs/

Our job is to make the questions so painful that the only way to make the
pain go away is by thinking.    - Fred Friendly

[Mikkel]

lux wrote:
>  
>  I'm not sure that Mikkel's solution will work:
>  
>  "Pseudo-terminal will not be allocated because stdin is not a terminal"
>  
>  will be the error message.
>  
>   
You can try adding the -t option to the command to run on PC A.

Mikkel
-- 

   Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[L]

On Fri, May 30, 2008 at 5:24 AM, François Patte <
francois.patte(a)math-info.univ-paris5.fr&gt; wrote:

>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  Le 29.05.2008 14:11, lux a écrit :
>
>  | Hi,
>  | I routinely login a remote server via a 'gateway' machine. For example,
>  | I need to login to PC B using ssh. But this PC B is behind a
>  | firewall.ssh port on PC A is open.
>  |
>  | As a result, I have to login  PC A via ssh, then ssh PC B from PC A.
>  |
>  | Is there ssh command line option that I can directly ssh to PC B?
>
>  I think that you have to make some firewall rules on your gw to allow
>  NAT to PC B
>  
I don't have control on the gw for NAT .


>  I'm not sure that Mikkel's solution will work:
>
>  "Pseudo-terminal will not be allocated because stdin is not a terminal"
>
>  will be the error message.
>  
Yes, I got the same error, as

Pseudo-terminal will not be allocated because stdin is not a terminal.
Host key verification failed.



>  - --
>  François Patte
>  UFR de mathématiques et informatique
>  Université Paris Descartes
>  45, rue des Saints Pères
>  F-75270 Paris Cedex 06
>  Tél. [phone]
>
> http://www.math-info.univ-paris5.fr/~patte<http://www.math-info.univ-p...
> >  -----BEGIN PGP SIGNATURE-----
> >  Version: GnuPG v1.4.7 (GNU/Linux)
> >  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
> >
> >  iD8DBQFIPwLQdE6C2dhV2JURAoTxAJ9vK1MopdjbpZyy+KYrzPMhrupnYQCfYLzt
> >  1tVvpf2oidbvtPo9pxbYqds=
> >  =64Mp
> >  -----END PGP SIGNATURE----- 
>  --
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>

[François Patte]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Le 29.05.2008 14:11, lux a écrit :
| Hi,
| I routinely login a remote server via a 'gateway' machine. For example,
| I need to login to PC B using ssh. But this PC B is behind a
| firewall.ssh port on PC A is open.
|
| As a result, I have to login  PC A via ssh, then ssh PC B from PC A.
|
| Is there ssh command line option that I can directly ssh to PC B?

I think that you have to make some firewall rules on your gw to allow
NAT to PC B

I'm not sure that Mikkel's solution will work:

"Pseudo-terminal will not be allocated because stdin is not a terminal"

will be the error message.

- --
François Patte
UFR de mathématiques et informatique
Université Paris Descartes
45, rue des Saints Pères
F-75270 Paris Cedex 06
Tél. [phone]
http://www.math-info.univ-paris5.fr/~patte
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iD8DBQFIPwLQdE6C2dhV2JURAoTxAJ9vK1MopdjbpZyy+KYrzPMhrupnYQCfYLzt
> 1tVvpf2oidbvtPo9pxbYqds=
> =64Mp
> -----END PGP SIGNATURE-----

[Mikkel]

lux wrote:
>  Hi,
>  I routinely login a remote server via a 'gateway' machine. For example, 
>  I need to login to PC B using ssh. But this PC B is behind a 
>  firewall.ssh port on PC A is open.
>  
>  As a result, I have to login  PC A via ssh, then ssh PC B from PC A.
>  
>  Is there ssh command line option that I can directly ssh to PC B?
>  
>  Thanks
>  Y
>   
You could try something like:

ssh [options] user@A "ssh [options] user@B"

You can skip the user@ part if you have the same user name.

ssh -Y PC_A "ssh -Y frank@PC_B"

Mikkel
-- 

   Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Cameron Simpson]

On 03Jun2008 10:31, lux <yuanlux(a)gmail.com&gt; wrote:
| On Mon, Jun 2, 2008 at 4:38 PM, Cameron Simpson <cs(a)zip.com.au&gt; wrote:
| > On 02Jun2008 16:23, lux <yuanlux(a)gmail.com&gt; wrote:
| > | > >> I have a script called "sshto" that does exactly this for
multihop
| > ssh
| > | > >> connections. [...]
| > | Sounds a  very interesting tool. I gave it a try. But
| > | what is shqstr?
| > | looks a like a command, but not in my system
| >
| > Yeah, sshto shamelessly uses other scripts from that same collection.
| > Shqstr quotes strings for handing to eval/sh/remote-ssh intact.
| > The simplest thing is to go to:
| >   http://www.cskk.ezoshosting.com/cs/css/
| > and download the tarball, unpack into /opt/css. [...]
| 
| Thanks a lot, I will try it.

Cool. The purpose of sshto is that it knows how to construct the right
proxycommand for you:-)

Oh yes, you will probably need the "nc" command (netcat) on the gateway
machine. Or the target machine, at the expense of an extra hop - I'll
elaborate on that if you turn out to need it. This is because, if sshto
uses proxycommand (i.e. it is multihop), it uses "nc host 22" to do the
final connection to the target ssh daemon (on labpc in your case).

| I followed your hint of ProxyCommand
| here is the .ssh/config file:
| 
| Host labpc
|         ProxyCommand ssh  lux@gw -t -w 3 labpc 22
| 
| When
| 
| ssh labpc
| 
| I got two layers of prompt for login. there were possible outputs:
| 
| 1st, sometime, I got login to labpc , but it last 1 or 2 seconds, and get
| discconetctd with this message:Connection to labpc closed by remote host.
| 
| the 2nd output is failure to login and got this message:
| Write failed: Broken pipe
| 
| any suggest? thanks

Yes. Start an ssh-agent, add your key to it, add forwardagent to your
ssh config file. Then no prompting will be needed. Pretty much all batch
or multihop stuff will need an agent to avoid prompting for passwords.

Also, always put ssh options before the "user@host", it is less
ambiguous. Eg:

  ProxyCommand ssh -t -w 3 lux@gw

You should not need (and in fact should probably _avoid_) the -t option
for the proxy command - it really should not use a terminal. I have not
used the -w options myself, and again they should not be in the
proxycommand, they should be in your upper-level ssh that _uses_ the
proxycommand. I don't know why you have "labpc 22" on the end of that.

A guess:

  Host labpc
    ProxyCommand ssh lux@gw

but be sure to set up ssh-agent first.

Cheers,
-- 
Cameron Simpson <cs(a)zip.com.au&gt; DoD#743
http://www.cskk.ezoshosting.com/cs/

Sue Ralph Nader, too, he was supposed to have prevented this kind of thing by
now.  Oh, and my fee is 40%     - Ed "gettabike" Green, rec.motorcycles