ssh ProxyCommand
2011-12-05 10:50
357 查看
The ssh ProxyCommand option is just really insanely useful.The reason I want to use it is that it makes it easy to tunnel ssh through a firewall. So for example you have a machineon your corporate network that is is sitting behind a firewall,but you have
a login to the firewall. Now of course you could justdo:
or something like:
But that really doesn't work very well if you use scp or sftpor some other service like revision control that runs on top of it.This is where you can use ProxyCommand option to make your life easier.Basically you want to put something like this into you
.ssh/config:
For this to work you will need netcat (nc) installed on thegw, but that generally isn't too much of a problem. Now you can transparently ssh, scp or whatever to internal, and ssh deals with it.
Now of course if you can't get into the network full stop, you need some reverse tunneling tricks and some other host on the interwebwhich you can use to tunnel through. So something like:
Will setup a remote tunnel, which basically means if you connect toport 1100, it will be forwarded to port 22 on the machine on which youran
get seemlessaccess to it.
Like totally awesome page, dude!
One tiny correction: "gw" in your config example should be "gateway"
Thanks for pointing that out, not sure how I messed that up.
a login to the firewall. Now of course you could justdo:
laptop$ ssh gateway gateway$ ssh internal internal$
or something like:
laptop$ ssh -t gateway ssh internal internal$
But that really doesn't work very well if you use scp or sftpor some other service like revision control that runs on top of it.This is where you can use ProxyCommand option to make your life easier.Basically you want to put something like this into you
.ssh/config:
Host internal ProxyCommand ssh gw nc -w 1 internal 22
For this to work you will need netcat (nc) installed on thegw, but that generally isn't too much of a problem. Now you can transparently ssh, scp or whatever to internal, and ssh deals with it.
Now of course if you can't get into the network full stop, you need some reverse tunneling tricks and some other host on the interwebwhich you can use to tunnel through. So something like:
ssh -f -nNT -R 1100:localhost:22 somehost
Will setup a remote tunnel, which basically means if you connect toport 1100, it will be forwarded to port 22 on the machine on which youran
ssh -R. Unfortunately unless you have full controlover the host you are creating the reverse tunnel too, you will findthat port 1100, will only be bound to localhost, which means you will probably still need to use the trick mentioned above to
get seemlessaccess to it.
Like totally awesome page, dude!
One tiny correction: "gw" in your config example should be "gateway"
Thanks for pointing that out, not sure how I messed that up.
相关文章推荐
- ssh ProxyCommand
- SSH ProxyCommand
- SSH ProxyCommand 实践
- SSH proxycommand:利用跳板机让不在同一局域网的机器ssh直连
- SSH ProxyCommand及其思想
- ssh-agent && ssh-agent forward && SSH ProxyCommand
- proxychins+ssh使用socks5代理
- ssh执行远程服务器脚本 提示php: command not found
- SSH 在中出现的could not initialize proxy - no Session 问题
- ssh-copy-id: command not found
- ssh执行远程服务器脚本 提示php: command not found
- SSH整合出现如下错误`Class_$$_javassist_0`代理类不能转换成 `javassist. util. proxy. Proxy`类型
- window系统命令行设置proxy----Setting a proxy for Windows using the command-line
- SSH整合之could not initialize proxy异常解决方案
- SSH整合遇到的问题:model $$_javassist_13 cannot be cast to javassist.util.proxy.Proxy
- ubuntu翻墙(ssh+autoproxy)
- convert ssh tunnel to http proxy
- xshell出现unknown command "free"是因为用的是sftp,而不是 ssh方式登录
- Git生成公钥 bash:ssh-keygen command not found