Trick in ssh config fails due to DNS lookups
Clash Royale CLAN TAG#URR8PPP
We use a special ssh proxy which forces me to connect to servers using this syntax: ssh myuser@privilegeduser@server.sub.domain@crappysshproxy.sub.domain.
Btw: this proxy is called PSMP and belongs to the CyberArk product suite, it is not a jump or bastion host, although is seems to be similar because I do not have direct access to the servers and only the proxy is reachable.
To shorten this I tried the following ~/.ssh/config:
Host server
HostName privilegeduser@server.sub.domain@crappysshproxy.sub.domain
User myuser
Why I then do ssh server I get ssh: Could not resolve hostname privilegeduser@server.sub.domain@crappysshproxy.sub.domain: Name or service not known.
I tried to add these ...
CheckHostIP no
VerifyHostKeyDNS no
... to my ssh config and this ...
UseDNS no
... to the global ssh config.
Can I keep ssh from doing a DNS lookup and make it just use User+HostName for connections ?
I am not searching for a solution that makes me create shortcut bash scripts like server.sh that does the concatenation for me and I do not want to alias / replace the ssh command.
ssh
asked Feb 26 at 16:07
MargedMarged
185111
|
show 8 more comments
We use a special ssh proxy which forces me to connect to servers using this syntax: ssh myuser@privilegeduser@server.sub.domain@crappysshproxy.sub.domain.
Btw: this proxy is called PSMP and belongs to the CyberArk product suite, it is not a jump or bastion host, although is seems to be similar because I do not have direct access to the servers and only the proxy is reachable.
To shorten this I tried the following ~/.ssh/config:
Host server
HostName privilegeduser@server.sub.domain@crappysshproxy.sub.domain
User myuser
Why I then do ssh server I get ssh: Could not resolve hostname privilegeduser@server.sub.domain@crappysshproxy.sub.domain: Name or service not known.
I tried to add these ...
CheckHostIP no
VerifyHostKeyDNS no
... to my ssh config and this ...
UseDNS no
... to the global ssh config.
Can I keep ssh from doing a DNS lookup and make it just use User+HostName for connections ?
I am not searching for a solution that makes me create shortcut bash scripts like server.sh that does the concatenation for me and I do not want to alias / replace the ssh command.
ssh
asked Feb 26 at 16:07
MargedMarged
185111
The best solution seems an alias indeed....
– Rui F Ribeiro
Feb 26 at 16:11
you might find better luck with ProxyJump; I haven't played with it enough to Answer.
– Jeff Schaller
Feb 26 at 16:11
1
Does this work?HostName crappysshproxy.sub.domainandUser myuser@privilegeduser@server.sub.domain? I'm fairly sure ssh will splituser@hoston the last@, so I think that's equivalent to your ssh command-line that works.
– filbranden
Feb 26 at 16:24
1
@filbranden This looks promising, but now I have a new problem because some calls tosshare created withpublickey -o PasswordAuthentication=noautomatically and this interferes (btw: no, I can not use keys for now ;-)) with my other settings. I will check this and update my question
– Marged
Feb 26 at 17:00
1
@filbranden I asked for all of this because Ansible spawns ssh for me.ssh serverworked from the shell but Ansible adds more commands. So I had to add--ask-passto my Ansible command line. This then worked.
– Marged
Feb 26 at 18:09
|
show 8 more comments
We use a special ssh proxy which forces me to connect to servers using this syntax: ssh myuser@privilegeduser@server.sub.domain@crappysshproxy.sub.domain.
Btw: this proxy is called PSMP and belongs to the CyberArk product suite, it is not a jump or bastion host, although is seems to be similar because I do not have direct access to the servers and only the proxy is reachable.
To shorten this I tried the following ~/.ssh/config:
Host server
HostName privilegeduser@server.sub.domain@crappysshproxy.sub.domain
User myuser
Why I then do ssh server I get ssh: Could not resolve hostname privilegeduser@server.sub.domain@crappysshproxy.sub.domain: Name or service not known.
I tried to add these ...
CheckHostIP no
VerifyHostKeyDNS no
... to my ssh config and this ...
UseDNS no
... to the global ssh config.
Can I keep ssh from doing a DNS lookup and make it just use User+HostName for connections ?
I am not searching for a solution that makes me create shortcut bash scripts like server.sh that does the concatenation for me and I do not want to alias / replace the ssh command.
ssh
asked Feb 26 at 16:07
MargedMarged
185111
We use a special ssh proxy which forces me to connect to servers using this syntax: ssh myuser@privilegeduser@server.sub.domain@crappysshproxy.sub.domain.
Btw: this proxy is called PSMP and belongs to the CyberArk product suite, it is not a jump or bastion host, although is seems to be similar because I do not have direct access to the servers and only the proxy is reachable.
To shorten this I tried the following ~/.ssh/config:
Host server
HostName privilegeduser@server.sub.domain@crappysshproxy.sub.domain
User myuser
Why I then do ssh server I get ssh: Could not resolve hostname privilegeduser@server.sub.domain@crappysshproxy.sub.domain: Name or service not known.
I tried to add these ...
CheckHostIP no
VerifyHostKeyDNS no
... to my ssh config and this ...
UseDNS no
... to the global ssh config.
Can I keep ssh from doing a DNS lookup and make it just use User+HostName for connections ?
I am not searching for a solution that makes me create shortcut bash scripts like server.sh that does the concatenation for me and I do not want to alias / replace the ssh command.
ssh
ssh
asked Feb 26 at 16:07
MargedMarged
185111
asked Feb 26 at 16:07
MargedMarged
185111
asked Feb 26 at 16:07
MargedMarged
185111
asked Feb 26 at 16:07
MargedMarged
185111
asked Feb 26 at 16:07
MargedMarged
185111
185111
The best solution seems an alias indeed....
– Rui F Ribeiro
Feb 26 at 16:11
you might find better luck with ProxyJump; I haven't played with it enough to Answer.
– Jeff Schaller
Feb 26 at 16:11
1
Does this work?HostName crappysshproxy.sub.domainandUser myuser@privilegeduser@server.sub.domain? I'm fairly sure ssh will splituser@hoston the last@, so I think that's equivalent to your ssh command-line that works.
– filbranden
Feb 26 at 16:24
1
@filbranden This looks promising, but now I have a new problem because some calls tosshare created withpublickey -o PasswordAuthentication=noautomatically and this interferes (btw: no, I can not use keys for now ;-)) with my other settings. I will check this and update my question
– Marged
Feb 26 at 17:00
1
@filbranden I asked for all of this because Ansible spawns ssh for me.ssh serverworked from the shell but Ansible adds more commands. So I had to add--ask-passto my Ansible command line. This then worked.
– Marged
Feb 26 at 18:09
|
show 8 more comments
The best solution seems an alias indeed....
– Rui F Ribeiro
Feb 26 at 16:11
you might find better luck with ProxyJump; I haven't played with it enough to Answer.
– Jeff Schaller
Feb 26 at 16:11
1
Does this work?HostName crappysshproxy.sub.domainandUser myuser@privilegeduser@server.sub.domain? I'm fairly sure ssh will splituser@hoston the last@, so I think that's equivalent to your ssh command-line that works.
– filbranden
Feb 26 at 16:24
1
@filbranden This looks promising, but now I have a new problem because some calls tosshare created withpublickey -o PasswordAuthentication=noautomatically and this interferes (btw: no, I can not use keys for now ;-)) with my other settings. I will check this and update my question
– Marged
Feb 26 at 17:00
1
@filbranden I asked for all of this because Ansible spawns ssh for me.ssh serverworked from the shell but Ansible adds more commands. So I had to add--ask-passto my Ansible command line. This then worked.
– Marged
Feb 26 at 18:09
The best solution seems an alias indeed....
– Rui F Ribeiro
Feb 26 at 16:11
The best solution seems an alias indeed....
– Rui F Ribeiro
Feb 26 at 16:11
you might find better luck with ProxyJump; I haven't played with it enough to Answer.
– Jeff Schaller
Feb 26 at 16:11
you might find better luck with ProxyJump; I haven't played with it enough to Answer.
– Jeff Schaller
Feb 26 at 16:11
1
1
Does this work?
HostName crappysshproxy.sub.domain and User myuser@privilegeduser@server.sub.domain? I'm fairly sure ssh will split user@host on the last @, so I think that's equivalent to your ssh command-line that works.– filbranden
Feb 26 at 16:24
Does this work?
HostName crappysshproxy.sub.domain and User myuser@privilegeduser@server.sub.domain? I'm fairly sure ssh will split user@host on the last @, so I think that's equivalent to your ssh command-line that works.– filbranden
Feb 26 at 16:24
1
1
@filbranden This looks promising, but now I have a new problem because some calls to
ssh are created with publickey -o PasswordAuthentication=no automatically and this interferes (btw: no, I can not use keys for now ;-)) with my other settings. I will check this and update my question– Marged
Feb 26 at 17:00
@filbranden This looks promising, but now I have a new problem because some calls to
ssh are created with publickey -o PasswordAuthentication=no automatically and this interferes (btw: no, I can not use keys for now ;-)) with my other settings. I will check this and update my question– Marged
Feb 26 at 17:00
1
1
@filbranden I asked for all of this because Ansible spawns ssh for me.
ssh server worked from the shell but Ansible adds more commands. So I had to add --ask-pass to my Ansible command line. This then worked.– Marged
Feb 26 at 18:09
@filbranden I asked for all of this because Ansible spawns ssh for me.
ssh server worked from the shell but Ansible adds more commands. So I had to add --ask-pass to my Ansible command line. This then worked.– Marged
Feb 26 at 18:09
|
show 8 more comments
1 Answer
1
active
oldest
votes
When you pass ssh an user@host setting, it will split that string on the last @ and use the first part (with @s if present) as the user name.
So the equivalent way to specify that in your .ssh/config is:
Host server
HostName crappysshproxy.sub.domain
User myuser@privilegeduser@server.sub.domain
answered Feb 26 at 17:55
filbrandenfilbranden
10.7k21746
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f503156%2ftrick-in-ssh-config-fails-due-to-dns-lookups%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
When you pass ssh an user@host setting, it will split that string on the last @ and use the first part (with @s if present) as the user name.
So the equivalent way to specify that in your .ssh/config is:
Host server
HostName crappysshproxy.sub.domain
User myuser@privilegeduser@server.sub.domain
answered Feb 26 at 17:55
filbrandenfilbranden
10.7k21746
add a comment |
When you pass ssh an user@host setting, it will split that string on the last @ and use the first part (with @s if present) as the user name.
So the equivalent way to specify that in your .ssh/config is:
Host server
HostName crappysshproxy.sub.domain
User myuser@privilegeduser@server.sub.domain
answered Feb 26 at 17:55
filbrandenfilbranden
10.7k21746
add a comment |
When you pass ssh an user@host setting, it will split that string on the last @ and use the first part (with @s if present) as the user name.
So the equivalent way to specify that in your .ssh/config is:
Host server
HostName crappysshproxy.sub.domain
User myuser@privilegeduser@server.sub.domain
answered Feb 26 at 17:55
filbrandenfilbranden
10.7k21746
When you pass ssh an user@host setting, it will split that string on the last @ and use the first part (with @s if present) as the user name.
So the equivalent way to specify that in your .ssh/config is:
Host server
HostName crappysshproxy.sub.domain
User myuser@privilegeduser@server.sub.domain
answered Feb 26 at 17:55
filbrandenfilbranden
10.7k21746
answered Feb 26 at 17:55
filbrandenfilbranden
10.7k21746
answered Feb 26 at 17:55
filbrandenfilbranden
10.7k21746
answered Feb 26 at 17:55
filbrandenfilbranden
10.7k21746
10.7k21746
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f503156%2ftrick-in-ssh-config-fails-due-to-dns-lookups%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The best solution seems an alias indeed....
– Rui F Ribeiro
Feb 26 at 16:11
you might find better luck with ProxyJump; I haven't played with it enough to Answer.
– Jeff Schaller
Feb 26 at 16:11
1
Does this work?
HostName crappysshproxy.sub.domainandUser myuser@privilegeduser@server.sub.domain? I'm fairly sure ssh will splituser@hoston the last@, so I think that's equivalent to your ssh command-line that works.– filbranden
Feb 26 at 16:24
1
@filbranden This looks promising, but now I have a new problem because some calls to
sshare created withpublickey -o PasswordAuthentication=noautomatically and this interferes (btw: no, I can not use keys for now ;-)) with my other settings. I will check this and update my question– Marged
Feb 26 at 17:00
1
@filbranden I asked for all of this because Ansible spawns ssh for me.
ssh serverworked from the shell but Ansible adds more commands. So I had to add--ask-passto my Ansible command line. This then worked.– Marged
Feb 26 at 18:09