This is because we are effectively sshing into two systems one right after the other. Now you may be wondering why it prompted me for two passwords. The result is a connection as if you were connecting from a trusted host: The Prox圜ommand then tells the system to first ssh to our bastion host and open a netcat connection to host %h (hostname supplied to ssh) on port %p (port supplied to ssh). | | =ssh=over=netcat=tunnel=> | |Ībove we tell ssh that when it establishes a connection to to do so using the stdin/stdout of the Prox圜ommand as a transport.

Your client then connects through the netcat tunnel and reaches the target server ssh/config file.Ī connection is established to the bastion hostīastion host runs netcat to establish a connction to the target server I was able to set up a method which allows for transparent access to a host while behind the scenes tunneling through a trusted bastion host involving some pretty minor adjustments to the. Or perhaps you have a number of hosts on a private subnet and only one routable host to get in through. This is decent security practice but is a total pain when you want to scp a file or grab the stdout of a command from a host outside the trusted area. Like most users out there (I think) my systems are usually configured to allow ssh connections from a small handfull of trusted hosts or a bastion host.

Creating a transparent SSH tunnel through a bastion host using the Prox圜ommand configuration parameter

Ssh tunnel bastion