I have no real idea what I'm doing here so please bear that in mind if you can help me!
I am trying to connect to my virtual server through a proxy but I can't connect, it just hangs. I'm assuming this is because it's not getting through our proxy.
I have tried exactly the same thing at home and it works perfectly. I'm on OSX using Terminal to connect.
Can anyone advise me how I can get through the proxy with SSH?
Here's how to do Richard Christensen's answer as a one-liner, no file editing required (replace capitalized with your own settings, PROXYPORT is frequently 80):
ssh USER#FINAL_DEST -o "ProxyCommand=nc -X connect -x PROXYHOST:PROXYPORT %h %p"
You can use the same -o ... option for scp as well, see my superuser answer.
If you get this in OS X:
nc: invalid option -- X
Try `nc --help' for more information.
it may be that you're accidentally using the homebrew version of netcat (you can see by doing a which -a nc command--/usr/bin/nc should be listed first). If there are two then one workaround is to specify the full path to the nc you want, like ProxyCommand=/usr/bin/nc ...
For CentOS nc has the same problem of invalid option --X. connect-proxy is an alternative, easy to install using yum and works --
ssh -o ProxyCommand="connect-proxy -S PROXYHOST:PROXYPORT %h %p" USER#FINAL_DEST
If your SSH proxy connection is going to be used often, you don't have to pass them as parameters each time. you can add the following lines to ~/.ssh/config
Host foobar.example.com
ProxyCommand nc -X connect -x proxyhost:proxyport %h %p
ServerAliveInterval 10
then to connect use
ssh foobar.example.com
Source here
I use -o "ProxyCommand=nc -X 5 -x proxyhost:proxyport %h %p" ssh option to connect through socks5 proxy on OSX.
Just a remark to #rogerdpack's answer: for windows platform it is really hard to find a nc.exe with -X(http_proxy), however, I have found nc can be replaced by ncat, full example as follows:
Host github.com
HostName github.com
#ProxyCommand nc -X connect -x 127.0.0.1:1080 %h %p
ProxyCommand ncat --proxy 127.0.0.1:1080 %h %p
User git
Port 22
IdentityFile D:\Users\Administrator\.ssh\github_key
and ncat with --proxy can work perfectly.
For windows, #shoaly parameters didn't completely work for me. I was getting this error:
NCAT DEBUG: Proxy returned status code 501.
Ncat: Proxy returned status code 501.
ssh_exchange_identification: Connection closed by remote host
I wanted to ssh to a REMOTESERVER and the SSH port had been closed in my network. I found two solutions but the second is better.
To solve the problem using Ncat:
I downloaded Tor Browser, run and wait to connect.
I got Ncat from Nmap distribution and extracted ncat.exe into the current directory.
SSH using Ncat as ProxyCommand in Git Bash with addition --proxy-type socks4 parameter:
ssh -o "ProxyCommand=./ncat --proxy-type socks4 --proxy 127.0.0.1:9150 %h %p" USERNAME#REMOTESERVER
Note that this implementation of Ncat does not support socks5.
THE BETTER SOLUTION:
Do the previous step 1.
SSH using connect.c as ProxyCommand in Git Bash:
ssh -o "ProxyCommand=connect -a none -S 127.0.0.1:9150 %h %p"
Note that connect.c supports socks version 4/4a/5.
To use the proxy in git commands using ssh (for example while using GitHub) -- assuming you installed Git Bash in C:\Program Files\Git\ -- open ~/.ssh/config and add this entry:
host github.com
user git
hostname github.com
port 22
proxycommand "/c/Program Files/Git/mingw64/bin/connect.exe" -a none -S 127.0.0.1:9150 %h %p
$ which nc
/bin/nc
$ rpm -qf /bin/nc
nmap-ncat-7.40-7.fc26.x86_64
$ ssh -o "ProxyCommand nc --proxy <addr[:port]> %h %p" USER#HOST
$ ssh -o "ProxyCommand nc --proxy <addr[:port]> --proxy-type <type> --proxy-auth <auth> %h %p" USER#HOST
ProxyCommand nc -proxy xxx.com:8080 %h %p
remove -X connect and use -proxy instead.
Worked for me.
This is how I solved it, hoping to help others later.
My system is debian 10, and minimal installation.
I also have the same problem like this.
git clone git#github.com:nothing/nothing.git
Cloning into 'nothing'...
nc: invalid option -- 'x'
nc -h for help
ssh_exchange_identification: Connection closed by remote host
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Or
git clone git#github.com:nothing/nothing.git
Cloning into 'nothing'...
/usr/bin/nc: invalid option -- 'X'
nc -h for help
ssh_exchange_identification: Connection closed by remote host
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
So, I know the nc has different versions like openbsd-netcat and GNU-netcat, you can change the nc in debian to the openbsd version, but I choose to change the software like corkscrew, because the names of the two versions of nc in system are same, and many people don’t understand it well. My approach is as follows.
sudo apt install corkscrew
Then.
vim ~/.ssh/config
Change this file like this.
Host github.com
User git
ProxyCommand corkscrew 192.168.1.22 8118 %h %p
192.168.1.22 and 8118 is my proxy server's address and port, you should change it according to your server address.
It's work fine.
Thanks #han.
I use proxychains ssh user#host; from proxychains-ng.
By default it uses a socks4 proxy at 127.0.0.1:9050 but it can be changed in the conf file /etc/proxychains.conf or you can specify another conf file like this: proxychains -f custom.conf
The easiest way to do this after OpenSSH 7.3 is with ProxyJump:
ssh USERNAME#HOSTNAME -J PROXYHOSTNAME
which is short hand for the ProxyCommand below (which works on older clients):
ssh USERNAME#HOSTNAME -o "ProxyCommand=ssh PROXYHOSTNAME -W %h:%p"
Or in your ssh config file ($HOME/.ssh/config):
Host HOSTNAME
User USERNAME
ProxyCommand ssh PROXYHOSTNAME -W %h:%p
The oldest clients require the use of netcat. YMMV depending on the version of netcat and options supported (see other answers).
I was using the following lines in my .ssh/config (which can be replaced by suitable command line parameters) under Ubuntu
Host remhost
HostName my.host.com
User myuser
ProxyCommand nc -v -X 5 -x proxy-ip:1080 %h %p 2> ssh-err.log
ServerAliveInterval 30
ForwardX11 yes
When using it with Msys2, after installing gnu-netcat, file ssh-err.log showed that option -X does not exist. nc --help confirmed that, and seemed to show that there is no alternative option to handle proxies.
So I installed openbsd-netcat (pacman removed gnu-netcat after asking, since it conflicted with openbsd-netcat). On a first view, and checking the respective man pages, openbsd-netcat and Ubuntu netcat seem to very similar, in particular regarding options -X and -x.
With this, I connected with no problems.
to connect to SOCKS5 proxy, simply run
ssh user#destination -o "ProxyCommand=nc -X 5 -x proxyhost:proxyport %h %p"
OR add proxy settings to .ssh/config
Host destinaion_host
HostName destinaion_host
User ali
ProxyCommand nc -X 5 -x proxyhost:proxyport %h %p
ServerAliveInterval 60
ServerAliveCountMax 10
then you can simply run ssh destinaion_host
with special thanks to #maxim-k
In my case since I had a jump host or Bastion host on the way, and because the signatures on these bastion nodes had changed since they were imported into known_hosts file, I just needed to delete those entries/lines from the following file:
/Users/a.abdi-kelishami/.ssh/known_hosts
From above file, delete those lines referring to the bastion hosts.
Try -o "ProxyCommand=nc --proxy HOST:PORT %h %p" for command in question. It worked on OEL6 but need to modify as mentioned for OEL7.
If anybody on CentOS / RHEL get
nc: invalid option -- 'X'
use this ProxyCommand
ProxyCommand nc --proxy HOST:PORT --proxy-type http %h %p
edit config file in:
.ssh/config
Host github.com
HostName github.com
User git
Port 22
ProxyCommand nc -X 5 -x 192.168.49.1:8000 %h %p
and test:
ssh -T git#github.com
Hi [username]! You've successfully authenticated, but GitHub does not provide shell access.
Related
I know that this question has been proposed several times (https://superuser.com/questions/606252/how-to-use-sshpass-for-chained-connection and https://unix.stackexchange.com/questions/320412/how-to-use-sshpass-to-supply-a-password-on-the-second-ssh-hop) but all the solutions that I've found until know are not working.
I'm tryng to access a third machine (third#machine) by using sshpass in order to not be prompted to insert a password. However,it is mandatory to use a bridge machine (bridge#machine) before entering the final one.
Each time I need to enter the passwords for the bridge#machine and for the third#machine, so my workflow is:
ssh bridge#machine
insert password:
ssh third#machine
insert password
Until now, I was able to avoid the first password by using sshpass in the proxycommand inside the ~.ssh/config file as follow:
vi ~.ssh/config :
Host *.reference
User example_user
ProxyCommand sshpass -p $bridge_machine_password$ ssh -o StrictHostKeyChecking=no bridge#machine "nc -w 60 `basename %h .reference` %p"
and contemporary I've define an alias named "curie" in the .bashrc file which is:
alias curie='ssh third#machine.reference'
So if run the alias curie I'm able to avoid the first password but I'm still prompted for the password of the third#machine.
For this reason I've tried to use sshpass to access the third#machine in the following manner:
>sshpass -p 'third_machine_password' ssh -oProxyCommand="ssh -W %h:%p bridge#machine" third#machine
Unfortunately, this gives back :
Permission denied, please try again.
Could be a restriction imposed by the third#machine or I'm doing something wrong?
if your password contains special characters such as $...
eg abcd#1234$$ then use \ with the special character....add this \ before each $$....it worked for me
Find a solution:
created firstly in the config file the proxy command
Host *.reference
User bridge
ProxyCommand sshpass -p passwd_bridge_machine2 ssh -o StrictHostKeyChecking=no bridge#machine2 "nc -w 60 `basename %h .ciment` %p"
after this command set in the config I created the alias in the .bashrc file:
alias curie='sshpass -p passw_third#machine3 ssh third#machine3.reference'
It is important to add the .reference line because it will firstly call the proxycommand in the config file and then use the sshpass in the alias. Once everything is settled it is only necessary to run the alias in the terminal to open the third machine withou any password.
Hope it helped someone else
I have a ssh command as below:
ssh -o ProxyCommand="ssh ubuntu#ip_addr -W %h:%p" ubuntu#ip_addr2 -L port:ip_addr3:port
I want to create a config file for this command, but I don't know what is the option of -L, here is my config file so far:
Host cassandra-khatkesh
User ubuntu
Hostname ip_addr2
ProxyCommand ssh ubuntu#ip_addr -W %h:%p
Anyone knows how can I add -L to config file?
-L corresponds to the LocalForward keyword.
Host cassandra-khatkesh
User ubuntu
Hostname ip_addr2
ProxyCommand ssh ubuntu#ip_addr -W %h:%p
LocalForward port ip_addr3:port
Note that the local and remote endpoints are specified separately, not as single :-delimited string.
I have an ansible playbook which connects to a virtual machine via a non-standard ssh port (forwarded to localhost) and a different user than the host user (vagrant).
The ssh port is specified in the ansible inventory:
[vms]
localhost:2222
The username given on the command line to ansible-playbook:
ansible-playbook -i <inventory from above> <some playbook> -u vagrant
The communication with the VM works correctly, however, %p always expands to 22 and %r to the host username.
Consequently, I cannot flush the SSH connection (for the user's changed group membership to take effect) like this:
- name: flush the ssh connection
command: ssh -o ControlPath="~/.ansible/cp/ansible-ssh-%h-%p-%r" -O stop {{inventory_hostname}}
delegate_to: 127.0.0.1
Am I making a silly mistake somewhere? Alternatively, is there a different way to flush the SSH connection?
The percent expand is not expanded by ansible, but by ssh later on.
Sorry, forgot to add the most important part
Using
command: ssh -o ControlPath=[...] -O stop {{inventory_hostname}}
will use default port, because you didn't specify it on the command-line. You would have to specify also the port to "flush" the connection this way:
command: ssh -o ControlPath=[...] -O stop -p {{inventory_port}} {{inventory_hostname}}
But I don't think it is needed. Ansible should clean up the connections when the playbook ends and I don't see any different reason why to do that.
I would like to use a ssh_config file instead of the traditional ~/.ssh/config. I have a simple configuration for accessing hosts through a bastion host (on port 23 for example).
ssh_config :
host bastion
hostname bastion.mydomain.com
port 23
host *.server
proxycommand ssh -W %h:%p bastion
ssh -F ssh_config test.server is not working and throw me "ssh: Could not resolve hostname bastion: Name or service not known".
But, if put this config in ~/.ssh/config, then ssh test.server works.
As I understand it, the proxycommand is unable to use the config file given in the command line.
If I want my command line config file to work, I need to put
proxycommand ssh -W %h:%p bastion.mydomain.com -p 23
but this seems to violate a simple DRY principle (the port and the domain are repeated). The config file I'm willing to build is much much longer and complex.
Is there a good way to achieve what I want, i.e. a simple, non-repeating, config file usable in command line for which proxycommand works ?
Half of an answer:
Rather than using the config file recursively, try not relying on the config at all for the proxy command.
host *.server
proxycommand ssh -W %h:%p bastion.mydomain.com -p 23
This allows it to be portable, but doesn't solve your other issue of having to do this on every line, and makes changing the bastion host address a difficult process.
you need to pass proxycommand ssh -W %h:%p bastion -F [your custom ssh config]
I have been struggling with setting up a ProxyCommand to ssh through multiple hops. The issue I am having is integrating arguments in my normal ssh statement into the config file. I want to connect to IP2 via IP1. My username is greg and I am connecting using rsa. This is the one liner that will connect me:
ssh -A -t -p 22 -i ~/.ssh/private_key greg#IP1 ssh -A -t greg#IP2
I have tried a bunch of different config set ups and currently I am using:
Host ezConnect
ProxyCommand ssh %h nc IP2 22
HostKeyAlias IP2
HostName IP1
User greg
I know the issue is that it does not include the arguments I need, but wherever I try to put them it seems to break.
The reason I'm doing this is because I need to use a db GUI (navicat) to connect through a gateway server and the UI doesn't support a strait up ssh command.
Any help would be appreciated.
I figured it out so here is the correct config fie:
Host ezCon
Hostname **IP2**
User greg
ProxyCommand ssh -l greg -p 22 -i ~/.ssh/private_key **IP1** -W %h:%p