Core Tunnel - ProxyCommand with other ssh connection

[yang (Yang.Y)]

Actually, the workflow can be simplified if use ProxyJump option:

Jump Hosts -- Passing Through a Gateway or Two

It is possible to connect to another host via one or more intermediaries so that the client can act as if the connection were direct. The main method is to use an SSH connection to forward the SSH protocol through one or more jump hosts, using the ProxyJump directive, to an SSH server running on the target destination host. This is the most secure method because encryption is end-to-end. In addition to whatever other encryption goes on, the end points of the chain encrypt and decrypt each oth…

Core Tunnel can read options from ~/.ssh/config:

Use system default `ssh_config` and `known_hosts` configuration

By default, Core Tunnel uses configuration files in its own container folder: # known_hosts ~/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/known_hosts # ssh_config ~/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/config This works very well in most of cases. But if you have a lengthy ~/.ssh/config or /etc/ssh/ssh_config, or have StrictHostKeyChecking set to yes and use ~/.ssh/known_hosts, /etc/ssh/ssh_known_hosts as the only source data trusted host keys, you may want to u…

[gerhard-tinned (Gerhard)]

Thanks for that input … you are amazing fast. Awesome!

I have tried to change the Configuration to “system” but it asks me to install the helper which is already installed. (Need it for ProxyCommand “corkscrew”).

[gerhard-tinned (Gerhard)]

It seems I had to install it again.

Strange. Is there anything known in that regards?

[yang (Yang.Y)]

The Core Helper tool also evolves with Core Tunnel / Shell, you may have an outdated version of Core Helper.

[gerhard-tinned (Gerhard)]

I installed it again jesterday. Did you releasae a new one since that?

On the other topic, … The proxy command with another ssh connection, I tried it with the proxy jump and it did not work. So I added the Proxy Command as I am used to.

ProxyCommand ssh hostname -W %h:%p

These are the last log lines with the error …

14:44:17 ssh_exchange_identification: Connection closed by remote host
14:44:17 The Core Helper process exited or crashed.
14:44:17 The Core Helper connection has terminated.
14:44:17 Abnormal Disconnect
14:44:17 Connection failed, retry after 3s…
14:44:20 Disconnected

[yang (Yang.Y)]

Could you please set debug level to DEBUG3 and paste the log again?

Enable logging

The default logging level is set to Info, Debug1, Debug2 and Debug3 each specify higher levels of verbose output. [image] Core Shell Open or go to Hosts tab, right click on the host and select Edit Settings… from context menu, navigate to Connection tab, then scroll down to Log Level option. Press ⌘ I (or select Shell -> Show Inspector from main menu) reveals shell session information, as well as log content. [image] Core Tunnel Navigate to tunnel's Settings…, Connection tab, then scrol…

Don't forget remove sensitive information.

[gerhard-tinned (Gerhard)]

Hi,

Here is the log output from Core Tunnel:

----------------------------------------
Equivalent Command: ssh -T -N -F "/Users/USER/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/config" -i "/Users/USER/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/privatekey/id_rsa" -vvv -D 1234 -o ExitOnForwardFailure=yes -o ProxyCommand="ssh JUMPHOST -W %h:%p" -p 22 REMOTEUSER@HOST.EXAMPLE.COM
09:45:43 Connecting…
09:45:43 OpenSSH_7.5p1, LibreSSL 2.5.5
09:45:43 debug1: Reading configuration data /Users/USER/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/config
09:45:43 debug1: /Users/USER/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/config line 7: Applying options for *
09:45:43 debug1: Executing proxy command: exec ssh JUMPHOST -W HOST.EXAMPLE.COM:22
09:45:43 Jumping…
09:45:43 debug1: key_load_public: No such file or directory
09:45:43 debug1: identity file /Users/USER/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/privatekey/id_rsa type -1
09:45:43 debug1: key_load_public: No such file or directory
09:45:43 debug1: identity file /Users/USER/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/privatekey/id_rsa-cert type -1
09:45:43 debug1: Enabling compatibility mode for protocol 2.0
09:45:43 debug1: Local version string SSH-2.0-OpenSSH_7.5
Permission denied, please try again.
Permission denied, please try again.
Received disconnect from UNKNOWN port 65535:2: Too many authentication failures for REMOTEUSER
Disconnected from UNKNOWN port 65535
09:45:44 ssh_exchange_identification: Connection closed by remote host
09:45:44 The Core Helper process exited or crashed.
09:45:44 The Core Helper connection has terminated.
09:45:44 Abnormal Disconnect
09:45:44 Connection failed, retry after 3s…
09:45:46 Disconnected

[yang (Yang.Y)]

From the log, it seems failed to authenticate the host JUMPHOST. Could you please try this command in Terminal.app, and paste the output?

ssh -T -N -F "/Users/USER/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/config" -i "/Users/USER/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/privatekey/id_rsa" -vvv -D 1234 -o ExitOnForwardFailure=yes -o ProxyCommand="ssh JUMPHOST -W %h:%p" -p 22 REMOTEUSER@HOST.EXAMPLE.COM

[gerhard-tinned (Gerhard)]

I have checked the server logs too. It seems that the JUMPHOST authentication failed. The JUMPHOST config comes from the ~/.ssh/config and works for sure as I use it daily.

The only thing I can think of is that the ssh-agent used to unlock the ssh-key (by the way the same as used in the Tunnel configuration) is not accessable. Can that be the reason?

[gerhard-tinned (Gerhard)]

It seems that is the problem. If i use the ssh command listed as “Equivalent Command”, it works. Must be related to the sandboxing or the fact that the ssh-agent is not accessed.

Enabling the Authentication Agent in the settings does not work for some reason. When I click the checkbox, the check-mark apears for a very short moment and disappears again. I checked the ssh-agent is running and lists my ssh-key.

[yang (Yang.Y)]

Could you please execute this command:

 echo $SSH_AUTH_SOCK

And also post your screenshot of Agent settings:

[gerhard-tinned (Gerhard)]

@yang

echo $SSH_AUTH_SOCK

$ echo $SSH_AUTH_SOCK
/var/folders//2q/831q73r13qjbmy1m_w0gbfy80000gn/T/ssh-uZzjhtt2lroU/agent.458

[gerhard-tinned (Gerhard)]

I restarted my Mac in the meantime and restarted Core Tunnel twice. Now I can enable the ssh-agent. Strange.

Still the authentication fails the same way.

[yang (Yang.Y)]

Please send me a screenshot of your agent setting in Preferences…

[gerhard-tinned (Gerhard)]

Now I reached a limit in the Support Website too ...

You’ve reached the maximum number of replies a new user can create on their first day. Please wait 29 minutes before trying again.

So I have to wait before I can send the Screenshot ...
While waiting I took the time to write together my goal with Core Tunnel.

• I have a ssh connection which should have a dynamic forward, lets kall it JUMPHOST
• To reach JUMPHOST, I need "corkscrew" to get through the http proxy.
• another connection to a server with another dynamic forward, lets call it DESTHOST
• To connect to test host, the connection needs to go through JUMPHOST (corkscrew will not work here)

So in my ~/.ssh/config it looks similar to this:

Host JUMPHOST
    ProxyCommand corkscrew ...
    DynamicForward ...
 
Host DESTHOST
    ProxyCommand ssh JUMPHOST -W %h:%p
    DynamicForward ...

That should be the most important settungs for that setup. Of course there are more but user name and host names are not important at this poiunt. This works greatr in the terminal. But when the connection(s) are dropped or disconnected for some reason, I have to manually start it again - annoing.

So I thought I can use Core Tunnel to do this. So far with limited luck. I am happy I did not buy it rigt away. So I am still in the testing phase ... Still hoping for the best.

[yang (Yang.Y)]

Please try setting the path of auth agent to the value of env $SSH_AUTH_SOCK.

ssh reads auth agent socket path from $SSH_AUTH_SOCK, if you change the value in ~/.bash_profile or ~/.bash_rc, Core Tunnel does not know anything about this change, so we must set it explicitly in Preferences…

[yang (Yang.Y)]

@gerhard-tinned

Now I reached a limit in the Support Website too …

Just raise the number of replies limitation, sorry about that.

[gerhard-tinned (Gerhard)]

Thank you for raising the limit.

I will try setting the path to the value of $SSH_AUTH_SOCKET. But this is just a workaround, right? Because after a reboot, that path will change.

What is the solution to it?

What I do in the badh config is simply the following.

• I check if a socket from ssh-agent can be found.
• if found, It is exported as the SSH_AUTH_SOCKET env variable
  -if not, ssh-agent is started and the variable is set too.

Any way, the variable is set as soon as the Terminal is opened the first time. Question is what dies Core Tunnel when the ssh-agent is not yet running? The path it detects seems to be something completely different then what ssh-agent usually creates.

[gerhard-tinned (Gerhard)]

BTW, for Testing all functionality, it would be great to have two connections In the test version.

[yang (Yang.Y)]

I guess you are not using the ssh utilities shipped with macOS, the system default ssh-agent daemon should creates a unix socket locates at dir /private/tmp/ and suffixed with Listeners.

System default ssh-agent daemon is launched by launchd and always starts up before Core Tunnel, so the SSH_AUTH_SOCK var is always ready when Core Tunnel starts.

If your ssh-agent not managed by launchd, then the SSH_AUTH_SOCK var may not set correctly for GUI applications.