YGG UNDERSTAND·OPEN·IMPROVE

ProxyJump: through a bastion without holding tunnels in your head

guide · linux

Machines on an internal network are usually reachable only through a bastion. Running ssh bastion and then ssh nas works, but scp, rsync and git cannot be used that way.

possibly outdated More than two years have passed since publication. The content may no longer hold.
01

One-off from the command line

ssh -J bastion.example.org nas.internal
02

Permanently in the configuration

In ~/.ssh/config:

Host bastion
  HostName bastion.example.org
  User admin

Host nas
  HostName nas.internal
  User admin
  ProxyJump bastion

From then on ssh nas, scp file nas:/tmp/, rsync -a ./data nas:/srv/ and git clone nas:/srv/git/repo.git all work with nothing else to arrange.

03

Why not ProxyCommand with netcat

Older guides use ProxyCommand ssh bastion nc %h %p. ProxyJump (OpenSSH 7.3 and newer) does the same thing without needing nc on the bastion, and keeps encryption between client and target entirely on the client – the bastion only sees a stream of bytes.

04

Chaining several hops

There can be more than one hop, separated by commas and traversed left to right:

ProxyJump edge,inner-bastion

Two things to watch. ProxyJump does not inherit IdentityFile from the target host – the bastion's key belongs to its own Host block. And if the bastion asks for a password it will ask on every connection; ControlMaster auto with ControlPath ~/.ssh/cm-%C and ControlPersist 10m reduces that to one – without ControlPath no shared connection is created.

← back to explore