In this tutorial, we will learn how to use SSH or SCP through a proxy server (jump host).
The sponsor of this guide is Bukh Global
SCP via proxy
Method 1: using scp with ProxyJump
In openssh package version 7.4p1-11 or newer we can use the option ProxyJump to transfer files using a proxy server.
The scp command syntax for proxy file transfers is:
# scp -o "ProxyJump <User>@<Proxy-Server>" <File-Name> <User>@<Destination-Server>:<Destination-Path>
For example:
# scp -o "ProxyJump [email protected]" dataFile.txt [email protected]:/tmp [email protected]'s password: [email protected]'s password: dataFile.txt
Where my proxy is 10.23.100.70 and the target server is 192.168.10.100.
Method 2: using scp with ProxyCommand
SCP uses ssh as its main protocol and hence we can use ssh options along with scp commands.
Setting up SSH to make your life easier
The syntax for using the ProxyCommand option with the scp command is:
# scp -o "ProxyCommand ssh <user>@<Proxy-Server> nc %h %p" <File-Name> <[email protected]<Destination-Server>:<Destination-Path>
Where:
- % h will be replaced with the hostname to connect
- % p will be replaced with port
When using the ProxyCommand parameter, make sure the nmap-ncat package is installed on the proxy server that provides the nc command, otherwise you will receive the following error message.
bash: nc: command not found ssh_exchange_identification: Connection closed by remote host lost connection
For example:
# scp -o "ProxyCommand ssh [email protected] nc %h %p" dataFile.txt [email protected]:/tmp [email protected]'s password: [email protected]'s password: dataFile.txt 100% 5 0.0KB/s 00:00
Where my proxy is 10.23.100.70 and the target server is 192.168.10.100.
SSH through a proxy server
Method 1: pass ProxyCommand using ssh parameters
We can again use the ProxyCommand to ssh login to another server using a proxy server.
The syntax for SSH over a proxy will be as follows:
# ssh -o "ProxyCommand ssh [email protected]_or_IP_of_proxy nc %h %p" [email protected]_or_IP_of_server
Example: login as root user at 192.168.10.100 through proxy at 10.23.100.70 with proxy credentials for proxy_user
# ssh -o "ProxyCommand ssh [email protected] nc %h %p" [email protected] [email protected]'s password: [email protected]'s password: Last login: Tue Dec 24 10:40:33 2019 from 10.23.100.70 # ip a l | grep eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000 inet 192.168.10.100/24 brd 192.168.1.255 scope global eth0
If the nc command is not installed on the proxy server, or you do not have proxy login credentials, but a proxy service such as squid is running on the proxy server that will accept SSH connections, you can use the following command.
Please note that this method requires you to have the nc command installed on your local / client system.
# ssh -o "ProxyCommand nc --proxy hostname_or_IP_of_proxy:proxy_service_port --proxy-type http %h %p" [email protected]_or_IP_of_server
For example, to log in as root on 192.168.10.100 through a proxy service listening on port 3128 on 10.23.100.70.
The proxy service does not require any credentials.
# ssh -o "ProxyCommand nc --proxy 10.23.100.70:3128 --proxy-type http %h %p" [email protected] [email protected]'s password: Last login: Tue Dec 24 10:40:46 2019 from 10.23.100.70 # ip a l | grep eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000 inet 192.168.10.100/24 brd 192.168.1.255 scope global eth0
Method 2: Using an ssh client config file
We discussed in detail the SSH client config file
? How to check the configuration of the OpenSSH client
? How to use SSH configuration for each Linux host
So instead of providing all the options as input arguments for SSH, we can also use the SSH client config file.
Edit the ~ / .ssh / config file as shown below:
# vim ~/.ssh/config ... Host <nickname> HostName <hostname_of_server> User <user_on_server> ProxyCommand ssh <user_on_server>@<proxy_server> nc %h %p
If this file already has content, you will need to add the above to the end of the file.
Where:
-
: Sets the alias for the target server. -
: sets the real name of the remote server / host -
: the real user that exists on the target server -
: IP or hostname of the proxy server - % h will be replaced with the hostname to connect
- % p will be replaced with port
Then you can use SSH with an additional verbose parameter to check the configuration
# ssh -vvv <target_server>
Conclusion
In this tutorial, we learned about the various methods to connect to a Linux server over SSH using another proxy or transfer files using SCP through a dproxy server or jump host.
You can use ProxyCommand or ProxyJump with ssh and scp respectively with ssh through any proxy service like squid or any other proxy.