Multi-Hop Connection

[bpkazemi]

Does Core Tunnel support multi-hop connections? My use case requires connecting through two jump boxes to a target:

local -> jump1 -> jump2 -> target

This post was really helpful, but I’m struggling figuring out how to make it work with a second jump box: Multi Tunnel SSH

These are the commands I’m running locally to get it to work:
(on local) ssh -L 1500:localhost:1500 jump1-user@jump1-ip
(on jump1) ssh -L 1500:target-ip:target-port jump2-user@jump2-ip

Is this possible?

[yang (Yang.Y)]

Core Tunnel support multi-hop out of the box, set the value of ProxyJump to this:

jump1-user@jump1-ip,jump2-user@jump2-ip

[bpkazemi]

Thanks Yang. One complication is I'm connecting to jump1 with user/pass, but to jump2 with a private key that lives on jump1. I'd need that key locally for it to work, right?

---

[yang (Yang.Y)]

@bpkazemi

but to jump2 with a private key that lives on jump1. I’d need that key locally for it to work, right?

AFAIK, if you use ProxyJump option,, you have to keep all required private keys locally.

There is a way that you can keep private key on jump1, but at the cost of intuitive, you can't utilize ProxyJump option to simplify the workflow, I'd rather not recommend you do that.

Let me know if you have no choice but to keep private key on jump1.

[bpkazemi]

As a policy I cannot bring the key down locally. Even if it’s less than perfect, can you share the non-intuitive approach?

[yang (Yang.Y)]

There is a similar question on SO, but using ssh command line:

SSH from A through B to C, using private key on B

The principle behind the selected answer also applies to Core Tunnel, but in your case, we need do some more extra job:

local ------> jump1 ------> jump2 ------> target
         ^             ^
   using local's  using jump1's
     ssh key        ssh key

Firstly, we must enable an advanced feature in Core Tunnel:

Use system default `ssh_config` and `known_hosts` configuration

By default, Core Tunnel uses configuration files in its own container folder: # known_hosts ~/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/known_hosts # ssh_config ~/Library/Group Containers/E78WKS7W4U.io.coressh.ssh/.ssh/config This works very well in most of cases. But if you have a lengthy ~/.ssh/config or /etc/ssh/ssh_config, or have StrictHostKeyChecking set to yes and use ~/.ssh/known_hosts, /etc/ssh/ssh_known_hosts as the only source data trusted host keys, you may want to u…

Then edit your ~/.ssh/config file and add some lines like this:

Host jump2
    ProxyCommand ssh -A jump1 'ssh-add && nc %h %p'

Then edit settings of your tunnel for target, set Proxy Jump option to jump2:

Then every thing should work. If you run into any problem, please enable debug log and paste at here (don't forget eliminate sensitive information):

Enable logging

The default logging level is set to Info, Debug1, Debug2 and Debug3 each specify higher levels of verbose output. [image] Core Shell Open or go to Hosts tab, right click on the host and select Edit Settings… from context menu, navigate to Connection tab, then scroll down to Log Level option. Press ⌘ I (or select Shell -> Show Inspector from main menu) reveals shell session information, as well as log content. [image] Core Tunnel Navigate to tunnel's Settings…, Connection tab, then scrol…

Good luck