You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Thomas Rainey <ra...@gmail.com> on 2021/11/15 17:32:48 UTC
SSH ProxyCommand
Hello,
Due to a variety of firewall and lab restrictions, I have the following
scenario. From Machine A, I ssh into Machine B where I have access to our
private lab.
From Machine B, I ssh (through Corkscrew) into a different private lab via
Machine C.
Corkscrew tunnels SSH over HTTP
Machine A --> Machine B --> Lab 1
Machine A --> Machine B (Corkscrew) --> Machine C --> Lab 2
I've been doing everything without Guacamole using plain old SSH and the
ProxyCommand, however, I'd like to see if I can get this to work with
Guacamole, since there are several additional benefits (RDP, VNC, etc,
within Lab 1).
I placed Guacamole on Machine B and it naturally works perfectly to any machine
in Lab 1. I was hoping that under the hood it would use my .ssh/config on
Machine B but it doesn't.
Are there any workarounds that I can use to solve this scenario
with Guacamole (SSH connections)?
Thanks
Re: SSH ProxyCommand
Posted by Thomas Rainey <ra...@gmail.com>.
I'm happy to report that it worked! Thank you for the suggestion.
On Tue, Nov 16, 2021 at 8:48 AM Thomas Rainey <ra...@gmail.com>
wrote:
> Thanks Hugaleno, I can give it a try and report back.
>
> On Mon, Nov 15, 2021 at 5:23 PM Hugaleno Bezerra <hu...@gmail.com>
> wrote:
>
>> I think you can workaround that using the remote command field.
>>
>> Something like
>> Host A ->login using ssh key> Host B
>>
>> Login into Host A using this remote command: bash -c "ssh user@172.. -o
>> StrictHostKeyChecking=no"
>>
>>
>> Em seg, 15 de nov de 2021 19:16, Thomas Rainey <ra...@gmail.com>
>> escreveu:
>>
>>> Hi Nick,
>>>
>>> Thanks for the quick response.
>>>
>>> Machine A (SSH) --> Machine B (SSH) --> (SSH - Corkscrew - HTTP) -->
>>> (HTTP - 10.xx.xx.xx ProxyServer - SSH) --> Machine C --> Lab 2
>>> Guacamole runs on Machine B
>>>
>>> Example: .ssh/config on Machine B:
>>> Host MachineC
>>> Hostname 172.xxx.xxx.xxx
>>> ServerAliveInterval 60
>>> User usr
>>> ProxyCommand /usr/bin/corkscrew 10.xx.xx.xx 3128 %h %p
>>> => ssh MachineC
>>>
>>> Example ssh command (not using .ssh/config) from Machine B to Machine C
>>> => ssh -o ProxyCommand="/usr/bin/corkscrew 10.xx.xx.xx 3128 %h %p"
>>> usr@172.xxx.xxx.xxx
>>> Thanks!
>>>
>>>
>>>
>>> On Mon, Nov 15, 2021 at 12:34 PM Nick Couchman <vn...@apache.org> wrote:
>>>
>>>> On Mon, Nov 15, 2021 at 12:34 PM Thomas Rainey <ra...@gmail.com>
>>>> wrote:
>>>>
>>>>> Hello,
>>>>>
>>>>> Due to a variety of firewall and lab restrictions, I have the
>>>>> following scenario. From Machine A, I ssh into Machine B where I have
>>>>> access to our private lab.
>>>>> From Machine B, I ssh (through Corkscrew) into a different private lab
>>>>> via Machine C.
>>>>>
>>>>> Corkscrew tunnels SSH over HTTP
>>>>>
>>>>> Machine A --> Machine B --> Lab 1
>>>>>
>>>>> Machine A --> Machine B (Corkscrew) --> Machine C --> Lab 2
>>>>>
>>>>
>>>>> I've been doing everything without Guacamole using plain old SSH and
>>>>> the ProxyCommand, however, I'd like to see if I can get this to work with
>>>>> Guacamole, since there are several additional benefits (RDP, VNC, etc,
>>>>> within Lab 1).
>>>>>
>>>>>
>>>>> I placed Guacamole on Machine B and it naturally works perfectly to
>>>>> any machine in Lab 1. I was hoping that under the hood it would use
>>>>> my .ssh/config on Machine B but it doesn't.
>>>>>
>>>>
>>>> No, guacd uses libssh2, which is completely separate from OpenSSH, so
>>>> it does not use the same config files.
>>>>
>>>>
>>>>>
>>>>>
>>>>> Are there any workarounds that I can use to solve this scenario
>>>>> with Guacamole (SSH connections)?
>>>>>
>>>>>
>>>>>
>>>> Not at the moment - it looks like the libssh2 library does support the
>>>> ProxyCommand feature, so it would be something to add in. Can you share
>>>> some generic form of the command that you're using for ProxyCommand that
>>>> can help us understand what is happening to facilitate that connection?
>>>>
>>>> -Nick
>>>>
>>>
Re: SSH ProxyCommand
Posted by Thomas Rainey <ra...@gmail.com>.
Thanks Hugaleno, I can give it a try and report back.
On Mon, Nov 15, 2021 at 5:23 PM Hugaleno Bezerra <hu...@gmail.com> wrote:
> I think you can workaround that using the remote command field.
>
> Something like
> Host A ->login using ssh key> Host B
>
> Login into Host A using this remote command: bash -c "ssh user@172.. -o
> StrictHostKeyChecking=no"
>
>
> Em seg, 15 de nov de 2021 19:16, Thomas Rainey <ra...@gmail.com>
> escreveu:
>
>> Hi Nick,
>>
>> Thanks for the quick response.
>>
>> Machine A (SSH) --> Machine B (SSH) --> (SSH - Corkscrew - HTTP) -->
>> (HTTP - 10.xx.xx.xx ProxyServer - SSH) --> Machine C --> Lab 2
>> Guacamole runs on Machine B
>>
>> Example: .ssh/config on Machine B:
>> Host MachineC
>> Hostname 172.xxx.xxx.xxx
>> ServerAliveInterval 60
>> User usr
>> ProxyCommand /usr/bin/corkscrew 10.xx.xx.xx 3128 %h %p
>> => ssh MachineC
>>
>> Example ssh command (not using .ssh/config) from Machine B to Machine C
>> => ssh -o ProxyCommand="/usr/bin/corkscrew 10.xx.xx.xx 3128 %h %p"
>> usr@172.xxx.xxx.xxx
>> Thanks!
>>
>>
>>
>> On Mon, Nov 15, 2021 at 12:34 PM Nick Couchman <vn...@apache.org> wrote:
>>
>>> On Mon, Nov 15, 2021 at 12:34 PM Thomas Rainey <ra...@gmail.com>
>>> wrote:
>>>
>>>> Hello,
>>>>
>>>> Due to a variety of firewall and lab restrictions, I have the following
>>>> scenario. From Machine A, I ssh into Machine B where I have access to our
>>>> private lab.
>>>> From Machine B, I ssh (through Corkscrew) into a different private lab
>>>> via Machine C.
>>>>
>>>> Corkscrew tunnels SSH over HTTP
>>>>
>>>> Machine A --> Machine B --> Lab 1
>>>>
>>>> Machine A --> Machine B (Corkscrew) --> Machine C --> Lab 2
>>>>
>>>
>>>> I've been doing everything without Guacamole using plain old SSH and
>>>> the ProxyCommand, however, I'd like to see if I can get this to work with
>>>> Guacamole, since there are several additional benefits (RDP, VNC, etc,
>>>> within Lab 1).
>>>>
>>>>
>>>> I placed Guacamole on Machine B and it naturally works perfectly to any machine
>>>> in Lab 1. I was hoping that under the hood it would use my .ssh/config on
>>>> Machine B but it doesn't.
>>>>
>>>
>>> No, guacd uses libssh2, which is completely separate from OpenSSH, so it
>>> does not use the same config files.
>>>
>>>
>>>>
>>>>
>>>> Are there any workarounds that I can use to solve this scenario
>>>> with Guacamole (SSH connections)?
>>>>
>>>>
>>>>
>>> Not at the moment - it looks like the libssh2 library does support the
>>> ProxyCommand feature, so it would be something to add in. Can you share
>>> some generic form of the command that you're using for ProxyCommand that
>>> can help us understand what is happening to facilitate that connection?
>>>
>>> -Nick
>>>
>>
Re: SSH ProxyCommand
Posted by Hugaleno Bezerra <hu...@gmail.com>.
I think you can workaround that using the remote command field.
Something like
Host A ->login using ssh key> Host B
Login into Host A using this remote command: bash -c "ssh user@172.. -o
StrictHostKeyChecking=no"
Em seg, 15 de nov de 2021 19:16, Thomas Rainey <ra...@gmail.com>
escreveu:
> Hi Nick,
>
> Thanks for the quick response.
>
> Machine A (SSH) --> Machine B (SSH) --> (SSH - Corkscrew - HTTP) --> (HTTP
> - 10.xx.xx.xx ProxyServer - SSH) --> Machine C --> Lab 2
> Guacamole runs on Machine B
>
> Example: .ssh/config on Machine B:
> Host MachineC
> Hostname 172.xxx.xxx.xxx
> ServerAliveInterval 60
> User usr
> ProxyCommand /usr/bin/corkscrew 10.xx.xx.xx 3128 %h %p
> => ssh MachineC
>
> Example ssh command (not using .ssh/config) from Machine B to Machine C => ssh
> -o ProxyCommand="/usr/bin/corkscrew 10.xx.xx.xx 3128 %h %p"
> usr@172.xxx.xxx.xxx
> Thanks!
>
>
>
> On Mon, Nov 15, 2021 at 12:34 PM Nick Couchman <vn...@apache.org> wrote:
>
>> On Mon, Nov 15, 2021 at 12:34 PM Thomas Rainey <ra...@gmail.com>
>> wrote:
>>
>>> Hello,
>>>
>>> Due to a variety of firewall and lab restrictions, I have the following
>>> scenario. From Machine A, I ssh into Machine B where I have access to our
>>> private lab.
>>> From Machine B, I ssh (through Corkscrew) into a different private lab
>>> via Machine C.
>>>
>>> Corkscrew tunnels SSH over HTTP
>>>
>>> Machine A --> Machine B --> Lab 1
>>>
>>> Machine A --> Machine B (Corkscrew) --> Machine C --> Lab 2
>>>
>>
>>> I've been doing everything without Guacamole using plain old SSH and the
>>> ProxyCommand, however, I'd like to see if I can get this to work with
>>> Guacamole, since there are several additional benefits (RDP, VNC, etc,
>>> within Lab 1).
>>>
>>>
>>> I placed Guacamole on Machine B and it naturally works perfectly to any machine
>>> in Lab 1. I was hoping that under the hood it would use my .ssh/config on
>>> Machine B but it doesn't.
>>>
>>
>> No, guacd uses libssh2, which is completely separate from OpenSSH, so it
>> does not use the same config files.
>>
>>
>>>
>>>
>>> Are there any workarounds that I can use to solve this scenario
>>> with Guacamole (SSH connections)?
>>>
>>>
>>>
>> Not at the moment - it looks like the libssh2 library does support the
>> ProxyCommand feature, so it would be something to add in. Can you share
>> some generic form of the command that you're using for ProxyCommand that
>> can help us understand what is happening to facilitate that connection?
>>
>> -Nick
>>
>
Re: SSH ProxyCommand
Posted by Thomas Rainey <ra...@gmail.com>.
Hi Nick,
Thanks for the quick response.
Machine A (SSH) --> Machine B (SSH) --> (SSH - Corkscrew - HTTP) --> (HTTP
- 10.xx.xx.xx ProxyServer - SSH) --> Machine C --> Lab 2
Guacamole runs on Machine B
Example: .ssh/config on Machine B:
Host MachineC
Hostname 172.xxx.xxx.xxx
ServerAliveInterval 60
User usr
ProxyCommand /usr/bin/corkscrew 10.xx.xx.xx 3128 %h %p
=> ssh MachineC
Example ssh command (not using .ssh/config) from Machine B to Machine C => ssh
-o ProxyCommand="/usr/bin/corkscrew 10.xx.xx.xx 3128 %h %p"
usr@172.xxx.xxx.xxx
Thanks!
On Mon, Nov 15, 2021 at 12:34 PM Nick Couchman <vn...@apache.org> wrote:
> On Mon, Nov 15, 2021 at 12:34 PM Thomas Rainey <ra...@gmail.com>
> wrote:
>
>> Hello,
>>
>> Due to a variety of firewall and lab restrictions, I have the following
>> scenario. From Machine A, I ssh into Machine B where I have access to our
>> private lab.
>> From Machine B, I ssh (through Corkscrew) into a different private lab
>> via Machine C.
>>
>> Corkscrew tunnels SSH over HTTP
>>
>> Machine A --> Machine B --> Lab 1
>>
>> Machine A --> Machine B (Corkscrew) --> Machine C --> Lab 2
>>
>
>> I've been doing everything without Guacamole using plain old SSH and the
>> ProxyCommand, however, I'd like to see if I can get this to work with
>> Guacamole, since there are several additional benefits (RDP, VNC, etc,
>> within Lab 1).
>>
>>
>> I placed Guacamole on Machine B and it naturally works perfectly to any machine
>> in Lab 1. I was hoping that under the hood it would use my .ssh/config on
>> Machine B but it doesn't.
>>
>
> No, guacd uses libssh2, which is completely separate from OpenSSH, so it
> does not use the same config files.
>
>
>>
>>
>> Are there any workarounds that I can use to solve this scenario
>> with Guacamole (SSH connections)?
>>
>>
>>
> Not at the moment - it looks like the libssh2 library does support the
> ProxyCommand feature, so it would be something to add in. Can you share
> some generic form of the command that you're using for ProxyCommand that
> can help us understand what is happening to facilitate that connection?
>
> -Nick
>
Re: SSH ProxyCommand
Posted by Nick Couchman <vn...@apache.org>.
On Mon, Nov 15, 2021 at 12:34 PM Thomas Rainey <ra...@gmail.com>
wrote:
> Hello,
>
> Due to a variety of firewall and lab restrictions, I have the following
> scenario. From Machine A, I ssh into Machine B where I have access to our
> private lab.
> From Machine B, I ssh (through Corkscrew) into a different private lab via
> Machine C.
>
> Corkscrew tunnels SSH over HTTP
>
> Machine A --> Machine B --> Lab 1
>
> Machine A --> Machine B (Corkscrew) --> Machine C --> Lab 2
>
> I've been doing everything without Guacamole using plain old SSH and the
> ProxyCommand, however, I'd like to see if I can get this to work with
> Guacamole, since there are several additional benefits (RDP, VNC, etc,
> within Lab 1).
>
>
> I placed Guacamole on Machine B and it naturally works perfectly to any machine
> in Lab 1. I was hoping that under the hood it would use my .ssh/config on
> Machine B but it doesn't.
>
No, guacd uses libssh2, which is completely separate from OpenSSH, so it
does not use the same config files.
>
>
> Are there any workarounds that I can use to solve this scenario
> with Guacamole (SSH connections)?
>
>
>
Not at the moment - it looks like the libssh2 library does support the
ProxyCommand feature, so it would be something to add in. Can you share
some generic form of the command that you're using for ProxyCommand that
can help us understand what is happening to facilitate that connection?
-Nick