The Computer Oracle

MOSH into bastion server, SSH into internal hosts

--------------------------------------------------
Rise to the top 3% as a developer or hire one of them at Toptal: https://topt.al/25cXVn
--------------------------------------------------

Music by Eric Matyas
https://www.soundimage.org
Track title: Puzzle Game 2 Looping

--

Chapters
00:00 Mosh Into Bastion Server, Ssh Into Internal Hosts
00:29 Accepted Answer Score 6
01:50 Answer 2 Score 2
02:22 Thank you

--

Full question
https://superuser.com/questions/816382/m...

--

Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...

--

Tags
#ssh #portforwarding

#avk47



ACCEPTED ANSWER

Score 6


You use ProxyCommand in your ssh config, and mosh mentions ProxyCommand in the error message. I think this is the vital clue. mosh uses ProxyCommand internally, and in doing so, it probably overrides your own setting.

I've avoided ProxyCommand with a manual port-forward invocation like this:

ssh -fN -L 2222:internal_host.example.com:22 bastion_host

Then I try to connect to localhost on port 2222:

mosh --ssh="ssh -p2222" internal_user@localhost

Instead of the ProxyCommand error, I get this:

mosh-server: invalid option -- 'l'
Usage: mosh-server new [-s] [-i LOCALADDR] [-p PORT] [-c COLORS] [-- COMMAND...]

I suspect that's due to different versions of mosh, as I see that even when using mosh directly without the bastion_host. In any case, a direct connection works despite the message, so I don't think that's the problem. Rather, I think the issue is that the port forwarding only handles port 22, while mosh also uses a UDP port in 60000:61000. ssh tunneling can not easily forward UDP traffic, so I think you may be better off using a different architecture.

I presume you want to use mosh for the first hop since your local machine may change networks, etc. Why not just use mosh and ssh like this (perhaps with an alias)?

mosh bastion_host ssh internal_user@internal_host



ANSWER 2

Score 2


I use mosh to connect to a bastion server, and run tmux within that session to maintain permanent connections to the internal servers. That might be more useful for your situation too.

UPDATE May 2019

I have changed my process a bit, and run tmux locally and now have a wrapper function for mosh in my ~/.zshrc. I've trimmed some of the details, but you'll get the gist:

function mosh() {
  case $@ in
  hostname)
    command mosh bastion.domain.com -- bash -c 'echo "Bouncing via bastion..." && echo && ssh hostname.domain.com'
    ;;
  *)
    command mosh "$@"
    ;;
  esac
}