I am currently using the following cmd to login to a ec2 instance using a jumphost -
ssh -J jumphost:2222 some_ip
I have installed csshX as I need to login to multiple instances simultaneously. I am not sure how to specify a jumphost in csshX.
Regards,
Aditya
You can use an ssh config, the default location being ~/.ssh/config which has a similar configuration, and ssh client honours it.
Host 192.168.*.*
ProxyCommand ssh jumphost -W %h:%p
and when you do csshX 192.168.0.10, it will go through the jumphost. (Tested and working from a mac.)
Related
I'm just trying to use PuTTY to get an SSH connection to my servers.
These servers allow incoming SSH connection only from another specific server ("MySshProxyingServer" in example below).
Using Linux this is no problem with the ssh -W command.
In PuTTY I can't find the options to create such a connection.
Example under Linux (~/.ssh/config):
Host MyHostToConnectTo
Hostname xx.xx.xx.xx
User root
Identityfile ~/.ssh/id_rsa
ProxyCommand ssh MySshProxyServer -W %h:%p
Anyone knows how to use such a config in PuTTY?
If you want to "jump a host", then using "local proxy command" is an overkill. Recent versions of PuTTY have this build-in. Go to Connection > Proxy, and in "Proxy type", select "SSH to proxy and use port forwarding". Then specify the details of the intermediate server below (like Hostname, Port, Username, Password [or load your private key to Pageant]).
(It's actually an overkill for OpenSSH too, as it has more user friendly options for this purpose too, see Does OpenSSH support multihop login?)
To answer your literal question: The equivalent in PuTTY is "local proxy command". You can use the plink.exe with the -nc switch instead of the ssh with the -W switch:
The "local proxy command" is:
plink.exe %user#%proxyhost -P %proxyport -nc %host:%port
An alternative is to open a tunnel via the "MySshProxyServer" first using another instance of PuTTY (or Plink).
See for example:
How to create SSH tunnel using PuTTY in Windows?
My guide for tunneling SFTP/SCP session. It's for WinSCP, but just use PuTTY instead of WinSCP in section Connecting through the tunnel.
Just in case you still use password for your jumphost is the option for that with an example.
plink.exe %user#%proxyhost -pw %pass -P %proxyport -nc %host:%port
When you want to start putty.exe from commandline it works this way:
putty.exe -proxycmd "plink.exe user#jumphost -P 22 -nc targethost:targetport" user#foo
According to the docs it uses stdin/stout of the proxycmd so "foo" is ok as target hostname here.
Suppose we want ssh to 172.16.0.21 via 8.8.8.8
login name in both hosts is john
path to private key is C:\users\john\.ssh\private.ppk
.
plink.exe -v -ssh %user#%proxyhost -P %proxyport -nc %host:%port -i "c:\Users\john\.ssh\private.ppk"
p.s.
If your private key has password protect then you must additionaly launch pageant and load your private key there
p.s.
if you want to use command line only then:
putty.exe -proxycmd "plink.exe john#8.8.8.8 -P 22 -nc 172.16.0.21:22 -i c:\Users\john\.ssh\private.ppk " john#172.16.0.21 -i c:\Users\john\.ssh\private.ppk
I am away from home, and need to proxy jump via my home server to connect to a number of sites.
The settings in .ssh/config work 100% of the time every time when executing from the command line, but coda simply refuses to use these connections.
Host home
Hostname my.home.server
Port 222
ProxyCommand bash -c '/usr/local/bin/knock -v %h $KNOCKS; sleep 1; exec /usr/bin/nc %h %p'
Host host1
Hostname host1.com
User root
Host home-host1
Hostname host1.com
User root
Host home-*
ProxyCommand ssh -W %h:%p home
So If I want to connect via home I:
ssh home-host1 and it jumps through my home to host1
Now this works all the time, every time for ssh via the console, but coda simply wont connect.
In the coda setup I have added home-host1 as the server and tried setting and clearing the user name and port so that just like ssh in a terminal everything comes from the config file.
I have also cleared known_hosts just in case it was caching something from there but no-go.
What am I doing wrong ??
Wow, after a lot more trial and error I succeeded.
coda does not appear to like ProxyJump but it will work with ProxyCommand
Host home-*
ProxyCommand ssh -W %h:%p home
I've looked [to faq][1] , but there is no answer for my task.
How can I access to bastion (jump box) host using password with Ansible? We do not consider using SSH keys. How will SSH config (or Ansible config) be look like for this situation?
For instance using SSH keys, the configuration looks like this:
ansible_ssh_common_args: '-o ProxyCommand="ssh -W %h:%p -q user#gateway.example.com"'
How to achieve the same result by using password?
You can use the ProxyJump ssh option which does not require netcat/nc to be installed on the jump host.
So in the ~/.ssh/config file of the user you are using to run the Ansible commands, add something like this
Host jumphost
HostName 1.1.1.1 # use actual ip address or fqdn
Host *
ProxyJump jumphost
In my ~/.ssh/config file, I have configured the bastion host like this:
##### Private hosts access through bastion host #####
Host bastion-host
HostName 52.13.2.54
ForwardAgent yes
Host 10.10.*
ProxyCommand ssh -q bastion-host nc -q0 %h %p
Then I can directly run the Ansible over the hosts in private subnet. Hope that might help you
I am running Ansible on my machine. And my machine does not have ssh access to the remote machine. Port 22 connection originating from local machine are blocked by the institute firewall. But I have access to a machine (ssh-tunnel), through which I can login to the remote machine. Now is there a way we can run ansible playbook from local machine on remote hosts.
In a way is it possible to make Ansible/ssh connect to the remote machine, via ssh-tunnel. But not exactly login to ssh-tunnel. The connection will pass through the tunnel.
Other way is I can install ansible on ssh-tunnel, but that is not the desired and run plays from there. But that would not be a desired solution.
Please let me know if this is possible.
There are two ways to achieve this without install the Ansible on the ssh-tunnel machine.
Solution#1:
Use these variables in your inventory:
[remote_machine]
remote ansible_ssh_host=127.0.0.1 ansible_ssh_port=2222 ansible_ssh_user='username' ansible_ssh_private_key_file='/home/user/private_key'
hope you understand above parameters, if need help please ask in comments
Solution#2:
Create ~/.ssh/config file and add the following parameters:
####### Access to the Private Server through ssh-tunnel/bastion ########
Host ssh-tunnel-server
HostName x.x.x.x
StrictHostKeyChecking no
User username
ForwardAgent yes
Host private-server
HostName y.y.y.y
StrictHostKeyChecking no
User username
ProxyCommand ssh -q ssh-tunnel-server nc -q0 %h %p
Hope that help you, if you need any help, feel free to ask
No request to install ansible on the jump and remote servers, ansible is ssh service only tool :-)
First make sure you can work it directly with SSH Tunnel.
On local machine (Local_A), you can login to Remote machine (Remote_B) via jump box (Jump_C).
login server Local_A
ssh -f user#remote_B -L 2000:Jump_C:22 -N
The other options are:
-f tells ssh to background itself after it authenticates, so you don't have to sit around running something on the remote server for the tunnel to remain alive.
-N says that you want an SSH connection, but you don't actually want to run any remote commands. If all you're creating is a tunnel, then including this option saves resources.
-L [bind_address:]port:host:hostport
Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side.
There will be a password challenge unless you have set up DSA or RSA keys for a passwordless login.
There are lots of documents teaching you how to do the ssh tunnel.
Then try below ansible command from Local_A:
ansible -vvvv remote_B -m shell -a 'hostname -f' --ssh-extra-args="-L 2000:Jump_C:22"
You should see the remote_B hostname. Let me know the result.
Let's say you can ssh into x.x.x.x from your local machine, and ssh into y.y.y.y from x.x.x.x, while y.y.y.y is the target of your ansible playbook.
inventory:
[target]
y.y.y.y
playbook.yml
---
- hosts: target
tasks: ...
Run:
ansible-playbook --ssh-common-args="-o ProxyCommand='ssh -W %h:%p root#x.x.x.x'" -i inventory playbook.yml
I would like to use a ssh_config file instead of the traditional ~/.ssh/config. I have a simple configuration for accessing hosts through a bastion host (on port 23 for example).
ssh_config :
host bastion
hostname bastion.mydomain.com
port 23
host *.server
proxycommand ssh -W %h:%p bastion
ssh -F ssh_config test.server is not working and throw me "ssh: Could not resolve hostname bastion: Name or service not known".
But, if put this config in ~/.ssh/config, then ssh test.server works.
As I understand it, the proxycommand is unable to use the config file given in the command line.
If I want my command line config file to work, I need to put
proxycommand ssh -W %h:%p bastion.mydomain.com -p 23
but this seems to violate a simple DRY principle (the port and the domain are repeated). The config file I'm willing to build is much much longer and complex.
Is there a good way to achieve what I want, i.e. a simple, non-repeating, config file usable in command line for which proxycommand works ?
Half of an answer:
Rather than using the config file recursively, try not relying on the config at all for the proxy command.
host *.server
proxycommand ssh -W %h:%p bastion.mydomain.com -p 23
This allows it to be portable, but doesn't solve your other issue of having to do this on every line, and makes changing the bastion host address a difficult process.
you need to pass proxycommand ssh -W %h:%p bastion -F [your custom ssh config]