Automatize multi-hop SSH and SCP with passwords

I want to access some host from my personal computer, but I have to access an intermediate server first, because the final destination cannot be seen from public internet.

The thing is that I have to do the following to access the final host. From my pc:

ssh username@server

And enter the password. Once I'm in there:

ssh username2@finalhost

And enter another password.

This is pretty cumbersome, specially when doing scp, because I have to copy the file to the intermediate server before being able to copy it to the final host.

Is there a way to make this process automatic, both for ssh and scp commands?

2 Answers

If you have OpenSSH 7.3 or later, you can use ProxyJump in your SSH client config to specify jump hosts.

For example, edit your ~/.ssh/config and add

Host finalhost
HostName finalhost.example.com
User username2
ProxyJump username@server

Now ssh finalhost or scp file.txt finalhost:. should go through the jump host.

Here is a short block of ~/.ssh/config that will do the tric (even for old ssh versions):

Host server User username
Host finalhost User username2 ProxyCommand ssh server -W %h:%p

You declare 2 hosts, the middle server and the final host. The ssh connection to the server is straightforward with the User and Host provided in the config. The connection to the finalhost performs a jump on the server as specified in the ProxyCommand line.

The two magic parameters %h and %p are used to forward the current Host = finalhost and current port = 22 (default)

Secondly, in order to prevent you from typing your password each time you connect to those machines, you can use the ssh-copy-id command:

ssh-copy-id server
<type server password for the last time>
ssh-copy-id finalhost
<type finalhost password for the last time>

For this to work you need to have generated a public-private key pair previously using ssh-keygen. You can check wether or not they already exist in the ~/.ssh folder (id_rsa.pub & id_rsa)