SSH Gateway in ~/.ssh/config

gatewayssh

What is the difference between the following?

Host foo
    ProxyCommand ssh example.com -- /usr/bin/nc %h %p 2> /dev/null

and

Host foo
    ProxyCommand ssh -W %h:%p example.com

Which one should I prefer when? Is either of them faster or more efficient in some way?

Best Answer

The two settings do the same thing. The -W option was added in 2010 and is described as a “netcat mode”.

Use ssh -W if you don't need compatibility with versions of OpenBSD prior to 4.7 or with portable OpenSSH prior to 5.5 (I think). Use nc if you do need to support older versions of OpenSSH. ssh -W is preferable if available because it's marginally more efficient and doesn't require a separate utility to be installed.

Related Solutions

SSH Tunneling – Local and Remote Use Cases

Second case is very useful in situation when example.com can connect to [google.com] host while your box can't. For example, you have VPN connection which is restricted to a number of boxes, while you want to access host not in list. ssh -L 123:target.host.com:456 user@vpn.host.com.

So, basic usage is to jump INSIDE the network or jump OUTSIDE the network (ssh to some kind of proxy/gateway).

And finally, there may be firewall restrictions on target server which accepts connections only from given hosts.

Ssh – How to use ssh-agent for offering host specific keys from ~/.ssh/config file and manage the passphrases

The issue can be resolved by doing the following:

Edit your client's ~/.ssh/config file such that the host entry has the following:
```
Host fooName
    Hostname foo.name.tld
    User usrname
    IdentityFile ~/.ssh/fooName.pub
    IdentitiesOnly yes
```
Note that the IdentityFile directive refers to the public key and not the private key file.
Add the relevant private key to ssh-agent using ssh-add. You should be prompted for a password at this time.

Best Answer

Related Solutions

SSH Tunneling – Local and Remote Use Cases

Ssh – How to use ssh-agent for offering host specific keys from ~/.ssh/config file and manage the passphrases

Related Question