My use case is I have to access AWS ec2 instances through a jumpbox.
Here is my SSH config.
Host awsjumpbox
User sshuser
HostName jumpboxhostname
IdentityFile /Users/myusername/.ssh/id_rsa
LocalForward 8022 10.0.168.43:22
It works when I do SCP command to copy files to the EC2 instance.
myusername % scp -r -i ~/aws/aws-keypair.pem -P 8022 * ec2-user#localhost:testdir
The authenticity of host '[localhost]:8022 ([::1]:8022)' can't be established.
ECDSA key fingerprint is SHA256:rrwr62yjP2cgUTT9SowdlrIwGi4jMMwt5x4Aj6E4Y3Y.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[localhost]:8022' (ECDSA) to the list of known hosts.
/etc/profile.d/lang.sh: line 19: warning: setlocale: LC_CTYPE: cannot change locale (UTF-8): No such file or directory
README.md 100% 1064 24.3KB/s 00:00
However, when I executed SSH command. It returns a strange IP address.
myusername % ssh -i ~/aws/aws-keypair.pem -P 8022 ec2-user#localhost
ssh: connect to host 0.0.31.86 port 22: No route to host
What is the cause of this issue? How do I fix it?
Thank you.
Don't use LocalForward and reverse the flow.
Use ProxyCommand or ProxyJump. This will allow SSH to open a session to your bastion server transparently.
E.g. your configuration should be something in the line of
Host 10.0.168.43
User root
ProxyCommand ssh -W %h:%p sshuser#awsjumpbox
...
or
Host 10.0.168.43
User root
ProxyJump sshuser#awsjumpbox
...
Related
ssh address I want to alias is
ssh -o StrictHostKeyChecking=no username#hostipaddress#jumpServerAdress.com
I am populating in the MAC ~/.ssh/config as
Host prod
HostName hostipaddress
User usrname
ServerAliveInterval 100
ProxyJump jumpServerAdress.com
StrictHostKeyChecking no
GlobalKnownHostsFile /dev/null
UserKnownHostsFile /dev/null
When I do ssh prod..
it is not letting me inside the host
It signals me:
channel 0: open failed: connect failed: open failed
stdio forwarding failed
ssh_exchange_identification: Connection closed by remote host
Is there any mistake in the config I am doing please let me know ?
I tried this config which worked
Host jump
HostName jumpServerAdress.com
User jumpuser
Host prod
HostName hostipaddress
User usrname
ServerAliveInterval 100
ProxyJump jump
StrictHostKeyChecking no
GlobalKnownHostsFile /dev/null
UserKnownHostsFile /dev/null
assuming you have setup ssh keys correctly.
I have a complex SSH tunnel problem I'm trying to solve and can't seem to get it quite right.
Simply put:
ME -> Bastion:22 -> Instance:8500
Bastion uses a different username and key than instance. I would like to be able to access port 1234 on instance from localhost:1234
Right now I have the following:
Host bastion
HostName bastion.example.com
ForwardAgent yes
IdentityFile ~/.ssh/id_ecdsa
User spanky
Host internal
ForwardAgent yes
HostName consul.internal
IdentityFile ~/.ssh/aws.pem
ProxyJump bastion
User ec2-user
Port 8500
But I don't think I've got it.
The following two commands work, but I'm trying to distill them into a working config:
ssh -L 2222:10.0.0.42:22 bastion.example.com -N -i ~/.ssh/id_ecdsa
ssh -L 8500:localhost:8500 ec2-user#localhost -N -i ~/.ssh/aws.pem -p 2222
With a current version of ssh, you should be able to use:
ssh -L1234:localhost:1234 -J spanky#bastion.example.com ec2-user#consul.internal
From man ssh:
-J destination
Connect to the target host by first making a ssh
connection to the jump host described by destination and then
establishing a TCP forwarding to the ultimate destination from there.
Multiple jump hops may be specified separated by comma characters.
This is a shortcut to specify a ProxyJump configuration directive.
I am configuring a local Hadoop cluster but I have a problem with password configurations.
When I type
ssh localhost
This message is displayed:
ssh localhost
key_load_public: invalid format
I already tried using these commands to replace my previous authorized keys:
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
But it did not work.
You can create a .config file in your ~/.ssh directory and then add the credentials.
Like this,
// ~/.ssh/config
# SSH Host configuration file
# Default for all
Host *
ForwardAgent no
ForwardX11 yes
ForwardX11Trusted yes
Host <hostname_here>
HostName <ip_address>
User <user_name>
Since it seems that your problems is more related with keys, you can try using ssh -i <your key file> username#ip_addr -p <port>
Instead of ssh "~/.ssh/somekey.pem" ubuntu#somehost, is there a way to make ssh auto check the ~/.ssh directory for keys so that I can simply do ssh "somekey.pem" ubuntu#somehost (i.e. omitting ~/.ssh)?
If you're using the same host then try updating your ~/.ssh/config file with the host info
Host dev
IdentityFile ~/.ssh/github.key
HostName dev.example.com
Port 22000
User fooey
then just type ssh dev to ssh in!
I am a new one to AWS service. Now, I have launched an instance in AWS named retest_den01. I want to connect it with ssh (mac os). I have a config file which is shown as following. Could you tell me how to get the host in AWS, what's the difference of Host and HostName. In addition, the meaning of ProxyCommand ssh -W %h:%p gateway.
Host gateway
HostName 54.199.245.48
User ec2-user
IdentityFile ~/.ssh/ei-d.pem
ServerAliveInterval 120
Host rmtest_den01
HostName 172.31.19.179
User ec2-user
IdentityFile ~/.ssh/ei-cloud.pem
ProxyCommand ssh -W %h:%p gateway
ServerAliveInterval 120
StrictHostKeyChecking no
UserKnownHostsFile=/dev/null
LocalForward 30383 localhost:30383
All of that is precisely explained in the manual page for ssh_config (good read to start!). But the the respective questions:
Could you tell me how to get the host in AWS
ssh rmtest_den01 should take you to your instance.
what's the difference of Host and HostName
`Host is start of the conditional block, evaluating only if the host you are using on the command-line matches the value next to that option.
HostName is the actual IP address or hostname your client is going to connect to.
In addition, the meaning of ProxyCommand ssh -W %h:%p gateway.
This means that to your hosts IP you can not connect directly from public internet, but only through the intermediate server gateway, which has its configuration above.
See my edit. The indentation does not matter, but helps to understand what is related to what.