SSH to multiple servers [Access denied]

Question

I need to write a script to remotely connect from home to my university server via ssh and then from the server terminal, ssh to a virtual machine to process some data. Is this possible?

This is what I have tried so far:

#!/usr/bin/expect
set login "myuser"
set addr "test.ac.uk"
set addr2 "t002"
set pw "mypassword"

spawn ssh -o StrictHostKeyChecking=no $login@$addr 
expect "$login@$addr\'s password:"
send "$pw\r"
expect "#"
spawn ssh -o StrictHostKeyChecking=no $login@$addr2 -p 22
expect "$login@$addr2\'s password:"
send "$pw\r"
expect "#"
send "cd /developer\r"
interact

Error: ssh: connect to host t002 port 22: Connection refused

This is the way I'm currently logging in manually from home successfully:

~/Desktop # ssh host

prompt to enter password.

Once logged on successfully.

-bash-4.2$ ssh user@t002

prompt to enter password again.

EDIT: I updated the second ssh line as suggested by Mike.

From:

spawn ssh -o StrictHostKeyChecking=no $login@$addr2 -p 22

To:

send "ssh -o StrictHostKeyChecking=no $login@$addr2 -p 22\r"

Now the script returns access denied, but at the same time it does log me into the server but not the virtual machine.

Answer 1

It is a common problem that you want to get to a server which is not directly accessible from the external internet, but it is accessible from a publicly exposed intermediate host. (The intermediate host is called a jumpbox.)

Since this problem is so common, it is natural that OpenSSH would provide convenience methods that simplify working with jumpboxes (or jumpboxen?). There are two ways, an old way and a new way. The old way still works, but the new way is more intuitive and makes fewer assumptions about what applications are available on the jumpbox.

Using the example machines mentioned in the question, it can be done like so:

ssh -o StrictHostKeyChecking=no -o [email protected] myuser@t002

Or, rather than -o [email protected], I think -W [email protected] is equivalent.

Either way, that method requires a new enough version of OpenSSH. If you get stuck with an old version, you need to do something like this:

ssh -o StrictHostKeyChecking=no -o ProxyCommand='ssh [email protected] "nc %h %p"' myuser@t002

The old way assumes you have netcat installed on the jumpbox.

Another benefit of the new way is you don't need to keep a private key on the jumpbox. ProxyJump is clever enough to try using the private key you have locally. So, if the jumpbox is compromised, it need not be able to compromise anything behind the jumpbox.

Now, you might get sick of writing out that big long command every time. The more you use ssh, the more incentive you will have to set up an $HOME/.ssh/config. That is a file where you can give aliases to remote hosts, and associate particular configurations with those hosts.

For your example, an ssh_config would be set up like so:

Host jumpbox
User myuser
Hostname test.ac.uk
StrictHostKeyChecking=no

Host t002
User myuser
StrictHostKeyChecking=no
ProxyJump jumpbox

With that configuration in place, you should now be able to log into t002 using a much simpler command:

ssh t002

There is a lot of other cool stuff you can do with an ssh_config. Have a look through man ssh_config and revisit it every now and then as you learn more about ssh. You'll keep finding more cool things you can do :)

An example introductory walkthrough to setting up an ssh config is https://www.cyberciti.biz/faq/create-ssh-config-file-on-linux-unix/

Answer 2

You spawn a new ssh. Try:

send "ssh -o StrictHostKeyChecking=no $login@$addr2 -p 22\r"

Answer 3

I would just use a command in a script to reduce typing, and type the user creds!

#!/bin/bash
ssh -o StrictHostKeyChecking=no [email protected] 'ssh -o StrictHostKeyChecking=no myuser@t002'

Tailor to your needs..

ssh -o StrictHostKeyChecking=no [email protected] 'ssh -tt -o StrictHostKeyChecking=no myuser@t002'

Copy the key from the 1st server to your pc and referance it like so:

ssh -o StrictHostKeyChecking=no [email protected] 'ssh -tt -o StrictHostKeyChecking=no -i /ssh/1stserverkey myuser@t002'