Introduction
In a production environment, it is recommended not to expose SSH access to production servers directly to the public internet. A jumpbox can be used as an intermediate server that has access to the production machines, while only the jumpbox is exposed for SSH access.
However, logging in to the jumpbox first and then connecting to every production server can be inconvenient. Using the SSH ProxyCommand option, you can connect directly from your local machine to the production server while automatically routing the SSH connection through the jumpbox.
Prerequisites
Before proceeding, make sure you have:
- Access to the jumpbox server.
- SSH access to the required production servers.
- The hostname or IP address of the jumpbox.
- The username required to access the jumpbox and production servers.
- SSH installed and configured on your local machine.
Implementation
Scenario/Use case:
Consider that we have a jumpbox that has access to all the production machines, and we don’t want to expose SSH access to the public. In such a scenario, we can allow only the jumpbox to be publicly accessible, and through the jumpbox, we can access the remaining machines. But it’s a pain to log in to the jumpbox and do ssh to the production hosts.
Solution:
Here comes the easy solution that we can apply from your local machine so we can directly SSH from your local machine.
Assumption:
- You should have access to the jumpbox as well production host. Otherwise, you will have to enter the password.
- Hostname or IP address of the jumpbox (In our case, we are using jumpbox.domain.tld)
On your local machine, open the terminal and open .ssh/config. This file may/may not exist. We can create the file and append the following content.
Host *
ProxyCommand ssh username@jumpbox.domain.tld nc %h %p 2> /dev/null
In the above case, when the user(username) tries to log in from their local machine, it will route the traffic through the jumpbox.
Advanced Use Case:
Let’s consider if we have the hostname all end with domain.tld and we can set up a jumpbox only particular to domain.tld.
Host *.domain.tld
ProxyCommand ssh username@jb.domain.tld nc %h %p 2> /dev/null
Conclusion
By configuring SSH ProxyCommand, you can connect directly to production servers from your local machine through the jumpbox. This eliminates the need to manually log in to the jumpbox before accessing production hosts and provides a convenient way to manage servers while keeping direct SSH access to production machines restricted.