in reply to ssh chain

You don't really need to create TCP tunnels to chain ssh connections.

You can do it as...

ssh -t shmem@gateway ssh -t admin@host.example.com \ ssh -t wrxd15@192.168.123.2 ssh -t root@192.168.254.2
You can also use ProxyCommand entries inside your ~/.ssh/config file to connect to remote servers in custom ways.

For instance, to connect to foo.net.org via other.server.org via my.server.org...

# .ssh/config Host foo ProxyCommand ssh me@my.server.org \ ssh me@other.server.org \ ssh root@foo.server.org /usr/sbin/sshd -i
And then...
ssh foo

Replies are listed 'Best First'.
Re^2: ssh chain
by shmem (Chancellor) on Sep 26, 2006 at 16:23 UTC
    Ah yes, but...
    ssh -t shmem@gateway ssh -t admin@host.example.com \ ssh -t wrxd15@192.168.123.2 ssh -t root@192.168.254.2

    ... I don't have the password for wrxd15@192.168.123.2, nor is this user allowed to login to 192.168.254.2 as root. The root passwords are generally unknown. It's my public key that is installed on each of these accounts in ~/.ssh/authorized_keys2, and my private key certainly won't leave my machine.

    Furthermore, with a complex network setup, and being forced to use multiple ways to connect to a remote site - that occurs generally after a service down alert has arrived - entries in ~/.ssh/config aren't that useful for me.

    I whipped the above cruft up because I need tunneling and forwarding of arbitrary local/remote ports to/from the remote host with changing requirements.

    <update>

    I need

    host1 host2 host3 +-------+ +-------+ +-------+ ssh 1 ----------\ | | | | | ssh 2 ---------------------\ | | | ssh 3 ================================> | ssh 2 ---------------------/ | | | ssh 1 ----------/ | | | | | +-------+ +-------+ +-------+

    rather than

    host1 host2 host3 +-------+ +-------+ +-------+ | | | | | | | | | | | | ssh 1 ======> ssh 2 ===> ssh 3 =======> | | | | | | | | | | | | | +-------+ +-------+ +-------+

    The most insane thing I do sometimes is tunneling a complete network via ppp through 5+ chained ssh's:

    host1 host2 host3 | | +-------+ +-------+ +-------+ | | ssh 1 ---------\ | | | | proxy | |n| ssh 2 --------------------\ | | arp | |e| ssh 3 --------------------------------\ \| |t| ppp ===== compress ======================^===== | ssh 3 --------------------------------/ | |w| ssh 2 --------------------/ | | | |o| ssh 1 ---------/ | | | | | |r| +-------+ +-------+ +-------+ |k|

    </update>

    --shmem

    _($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                                  /\_¯/(q    /
    ----------------------------  \__(m.====·.(_("always off the crowd"))."·
    ");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}
      This would appear to be an absolutely classic case for using agent forwarding.

      The TCP forwarding method is a little more resistant to interception on the intermediate hosts by someone with root privs, but this is pretty marginal in most situations.

      Personally I would (and do, frequently) use a chain of ssh with agent forwarding to get this effect.