I have a VPC in Amazon AWS. There's a NAT Server running in a Public Subnet that connects to an Internet Gateway. I have a bunch of servers running in various private subnets within the VPC. I'd like to SSH into the servers that are in the private subnet. All my servers are running AWS Linux (CentOS).
Currently, I can SSH into the NAT Server using my private key. The NAT server allows SSH connections only from my current development IP. Then I can SSH into the servers in the private subnets only if I setup SSH Login on those servers, or if I put a key file on the NAT server and then use them to SSH. For security, it seems like I shouldn't do either of these things.
Is there a preferred best-practice way to make this connection? It seems like there should be a way to connect with a single SSH call from my home development machine running Apple OSX.
Best Answer
You should not put your secret key on the gateway, and you don't have to :-)
setup your local SSH config so you can use the NAT gateway for port forwarding when you need it:
create an entry in your
~/.ssh/config
that sets up local forwards to the hosts you want to connect to:then add one entry per host forwarded with an
HostKeyAlias
:bring the tunnel up in one shell:
and connect to the internal hosts in another shell:
When using lots of "quick + short" connections in addition to a shell or two, as with a tool like dsh, latency for setup and teardown of single connections gets more noticeable, and I use
ControlMaster
andControlPath
to enable connection sharing. The limitations don't bother me because I rarely use agent or X11 in such a scenario.