Menu
I need to be able to connect to a host through another host because of firewall limitations. I'm currently able to connect successfully with the ProxyCommand option. But now I need to change the user after connecting to the destination host, from user_one to user_two.
My current config file:
Host destination
Hostname destination.example.com
User user_one
ProxyCommand ssh -W %h:%p fw.example.com
IdentityFile /Users/local_user/.ssh/id_rsa
I have all the necessary keys for connecting as user_one, but I need to sudo su user_two to be able to login as that user. And I need to act as that user in order to write files through sftp. (This is a webserver).
So how can I automatically switch to user_two?
950
You need an SSH client that can issue CONNECT requests through the company HTTP proxy. If you're on Windows, using Putty is fine as it has built-in support for tunneling through a HTTP proxy. If you're on unix/linux (or cywgin) you can use openssh with corkscrew to go through the proxy to your home computer's port 443.
The -W option ensures that the connection is forwarded over the secure channel and just passes through the jump host without being decrypted. The jump host must both be able to do the DNS look up for LAN names as well as have an SSH client available.
An SSH jump server is a proxy standing between clients and the rest of the SSH fleet. Jump hosts minimize threats by forcing all SSH traffic to go through a single hardened location and minimizing an individual node's SSH endpoints to the outside world. (Read more: “How to set up an SSH jump server.”)
User : Defines the username for the SSH connection. IdentityFile : Specifies a file from which the user's DSA, ECDSA or DSA authentication identity is read. The default is ~/. ssh/identity for protocol version 1, and ~/.
You can use RemoteCommand to switch users immediately after logging in. Your .ssh/config would then be:
Host destination
Hostname destination.example.com
User user_one
ProxyCommand ssh -W %h:%p fw.example.com
IdentityFile /Users/local_user/.ssh/id_rsa
RemoteCommand sudo su - user_two
RequestTTY yes
Note that you may also need to add RequestTTY yes, if the remote server requires a TTY when running sudo.
65
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
