3 ms·

The ProxyJump (-J) and Include directive features are huge! Really improves a lot of workflows where a tool like gcloud autoconfigures hosts in your SSH config

The ProxyJump (-J) and Include directive features are huge! Really improves a lot of workflows where a tool like gcloud autoconfigures hosts in your SSH config (and could now do so with a bastion host easily). A bit ironic openssh.com doesn't have HTTPS: http://www.openssh.com/txt/release-7.3 http://www.openssh.com/txt/release-7.3 Edit: corrected typo!

idsout 10y ago
I think ProxyJump is a nice way to explicitly state that you want to jump hosts, but this is currently possible with ProxyCommand, such as the following... Host appserver1 ProxyCommand ssh bastionhost.com -W %h:%p
- mineo 10y ago
  The announcement already mentions that ProxyJump is meant to be a simplified version of indirection, not a completely new feature.
- jlgaddis 10y ago
  commit ed877ef653847d056bb433975d731b7a1132a979 Author: djm@openbsd.org <djm@openbsd.org> Date: 3 weeks ago upstream commit Add a ProxyJump ssh_config(5) option and corresponding -J ssh(1) command-line flag to allow simplified indirection through a SSH bastion or "jump host". These options construct a proxy command that connects to the specified jump host(s) (more than one may be specified) and uses port-forwarding to establish a connection to the next destination. This codifies the safest way of indirecting connections through SSH servers and makes it easy to use. ok markus@ Upstream-ID: fa899cb8b26d889da8f142eb9774c1ea36b04397
- matt_wulfeck 10y ago
  That only sends commands via the proxy host. Jump allows you to connect to remote hosts via the jump host intermediary.
OrpheanBeholder 10y ago
> A bit ironic openssh.com doesn't have HTTPS You can however access the release notes (or any other file/page from the website for that matter) over SSH using CVS $ cvs -d anoncvs@anoncvs.ca.openbsd.org:/cvs get www/openssh/txt/release-7.3
- schmichael 10y ago
  Unless you've gotten anoncvs.ca.openbsd.org's host key fingerprint through some secure mechanism (say... HTTPS), SSH only encrypts the transport. It does nothing to stop a MITM (eg a malware injecting proxy).
  - OrpheanBeholder 10y ago
    Get the host fingerprints over TLS then? https://www.openbsd.org/anoncvs.html https://www.openbsd.org/anoncvs.html
    - jlgaddis 10y ago
      In which case ISTM that they could have just enabled HTTPS on www.openssh.com and saved us a few steps.
- deleted 10y ago
  [deleted]

idsout 10y ago

I think ProxyJump is a nice way to explicitly state that you want to jump hosts, but this is currently possible with ProxyCommand, such as the following... Host appserver1 ProxyCommand ssh bastionhost.com -W %h:%p

mineo 10y ago
The announcement already mentions that ProxyJump is meant to be a simplified version of indirection, not a completely new feature.
jlgaddis 10y ago
commit ed877ef653847d056bb433975d731b7a1132a979 Author: djm@openbsd.org <djm@openbsd.org> Date: 3 weeks ago upstream commit Add a ProxyJump ssh_config(5) option and corresponding -J ssh(1) command-line flag to allow simplified indirection through a SSH bastion or "jump host". These options construct a proxy command that connects to the specified jump host(s) (more than one may be specified) and uses port-forwarding to establish a connection to the next destination. This codifies the safest way of indirecting connections through SSH servers and makes it easy to use. ok markus@ Upstream-ID: fa899cb8b26d889da8f142eb9774c1ea36b04397
matt_wulfeck 10y ago
That only sends commands via the proxy host. Jump allows you to connect to remote hosts via the jump host intermediary.

OrpheanBeholder 10y ago

> A bit ironic openssh.com doesn't have HTTPS You can however access the release notes (or any other file/page from the website for that matter) over SSH using CVS $ cvs -d anoncvs@anoncvs.ca.openbsd.org:/cvs get www/openssh/txt/release-7.3

schmichael 10y ago
Unless you've gotten anoncvs.ca.openbsd.org's host key fingerprint through some secure mechanism (say... HTTPS), SSH only encrypts the transport. It does nothing to stop a MITM (eg a malware injecting proxy).
- OrpheanBeholder 10y ago
  Get the host fingerprints over TLS then? https://www.openbsd.org/anoncvs.html https://www.openbsd.org/anoncvs.html
  - jlgaddis 10y ago
    In which case ISTM that they could have just enabled HTTPS on www.openssh.com and saved us a few steps.
deleted 10y ago
[deleted]