ProxyJump doesn't use modified Config.default_files

[rosenfeld]

Hi, once I was able to use the ProxyJump local configuration in project/.ssh/config, but today I tried using this project again (through sshkit) and was getting this error: "#497".

It works if I run "ssh -F .ssh/config somehost". There's something like this in the configuration:

Host proxied
  Hostname 10.0.0.1
  ProxyJump root@100.100.100.100:22
  # this works, but it would be good to get the above working too:
  #ProxyCommand ssh -i /project/sshkeys/id_rsa -W %h:%p -p 22 root@100.100.100.100

Host *
  User root
  IdentityFile /project/sshkeys/id_rsa

It looks like the identity file wasn't being to both hosts. By the way, both 100.100.100.100 and 10.0.0.1 would be the same host. This may not make much sense but it simplifies some settings in our deployment scripts. Is there something wrong with the configuration above? I used to have it this way by the time the support for ProxyJump was introduced to net-ssh, but maybe something has changed since then.

[mfazekas]

@rosenfeld thanks for the bugreport, not sure what changed. If you can write a reprodicable testcase that might make it easier fixing the issue.

[rosenfeld]

Ok, today I'm in a hurry, but I'll see if I can get such test case tomorrow. Thanks

[rosenfeld]

It help if you could provide a working testcase so that I could check myself and perform any changes to reproduce the problem. I've never worked directly with net-ssh. Would it be okay to provide a testcase project involving sshkit instead?

[mfazekas]

Sure sshkit shoul be fine, ideal is an net-ssh only

[rosenfeld]

Hi, I could finally find some time to investigate this. I wasn't able to reproduce it using net-ssh only. So I guess it could be an issue with sshkit. I have to leave soon, but hopefully tomorrow I would have some time to try on sshkit. I'm closing this issue for now as I suspect it's not net-ssh's fault.

Thanks!

[rosenfeld]

I could not reproduce it with a simple example with sshkit either. I guess it will require more time before I'm able to provide an example where it fails...

[rosenfeld]

Actually, I was able to reproduce this issue using net-ssh only but it worked when I was testing against localhost. But against the real server it doesn't work for some reason I still don't understand. I'll let you know if I can get more details on how to reproduce it.

[rosenfeld]

Ok, I was able to track down what's happening. I use an entry such as "Host *" in order to specify the IdentityFile. When using "ssh -F .ssh/config myhost" it will use that IdentityFile for the ProxyJump as well, but it doesn't happen with net-ssh. If I remove the "Host *" configuration and put the IdentityKey directly in the "myhost" entry, then the behavior is the same as net-ssh.

Is it possible for net-ssh to handle "Host *" just like the ssh client does? That's fine if you want to keep the current behavior, but at least now I understand the reason why ProxyJump isn't working for this project. For the other project I have it probably works because the id_rsa is copied to the gateway's server at /root/.ssh/id_rsa. At least it's all clear to me right now :)

[mfazekas]

@rosenfeld sorry can you clarify it for me?

ProxyJump does pass config files you've specifed via config: option to net-ssh, doesn't it?

See https://github.com/net-ssh/net-ssh/pull/500/files

[rosenfeld]

Yes, but the ssh client behavior is different from net-ssh when "Host *" is used. If you have an IdentityFile specified under "Host *" the ssh client will use that when proxy jumping as well. I mean: "ssh -F .ssh/config myhost" would work fine because the IdentityFile would be used both to connect to the gateway and from the gateway to the final server. However, net-ssh will only use the IdentityFile to connect to the gateway and will then fail to connect to the final server. Please let me know if my explanation is still confusing.

[mfazekas]

Net-ssh should be calling ssh -F .ssh/config ... for proxy jump, if you invoked net-ssh with config: ".ssh/config"

Can you show your net-ssh script, and the way it invoked ssh for the proxy jump and what options do you think it should be passing to it instead?

However, net-ssh will only use the IdentityFile to connect to the gateway and will then fail to connect to the final server.

So the proxy jump raw ssh command does use the correct config file? But net-ssh doesn't interpret IdentityFile when connecting to target through proxy jump?

[rosenfeld]

test-case.rb:

require 'net/ssh'

Net::SSH::Config.default_files << File.expand_path('.ssh/config', __dir__)

Net::SSH.start('myhost', 'rodrigo') do |ssh|
  puts ssh.exec! 'hostname'
end

So the proxy jump raw ssh command does use the correct config file?

Yes, while connecting to the gateway.

But net-ssh doesn't interpret IdentityFile when connecting to target through proxy jump?

Exactly

[rosenfeld]

Here's how .ssh/config would look like:

Host myhost
  Hostname 127.0.0.1
  ProxyJump rodrigo@127.0.0.1
  User rodrigo

Host *
  # renamed ~/.ssh/id_rsa to ~/.ssh/id_rsa2, or otherwise it would work fine with net-ssh
  IdentityFile /home/rodrigo/.ssh/id_rsa2