Linux – Rewrite / Redirect Host With SSH Config File

configurationlinuxsshssh-agentssh-tunnel

My company has three separate jump hosts. Something like: jump1.example.com, jump2.example.com, and jump3.example.com

All internal servers must be accessed through these jumphosts:

local ---> jump1.example.com ---> internal.example.com

We have lots of internal servers, so to simplify I created a config file like so:

.ssh/config:

Host jump1.example.com jump2.example.com jump3.example.com
    ForwardAgent yes
    ProxyCommand none

Host *.example.com
    PubkeyAuthentication yes
    User sbarnett
    IdentityFile ~/.ssh/id_rsa
    IdentitiesOnly yes
    ProxyCommand ssh -q -W %h:%p jump1.example.com

Note that my public key is located on every one of these machines, so this setup works perfectly. I can type ssh internal.example.com and it will properly proxy through jump1.example.com and connect with my private key

Here's what I want to do, though: Instead of typing jump1.example.com or internal.example.com, I'd like to just type ssh jump1 or ssh internal

I know that this can be configured per host like so:

Host internal
    HostName internal.example.com
    PubkeyAuthentication yes
    User sbarnett
    IdentityFile ~/.ssh/id_rsa
    IdentitiesOnly yes
    ProxyCommand ssh -q -W %h:%p jump1.example.com

However if I try the much simpler:

Host internal
    HostName internal.example.com

Then my generic config options (under *.example.com) are not loaded when I try to use ssh internal — so it doesn't use the proxy and doesn't use the identity file, preventing me from connecting.

Is there a way to say "if the host name is *.example.com (not necessarily the host) then apply these settings"?

Bonus points for a way to redirect * to *.example.com if and only if * does not exist (e.g. – when connecting to git@github.com I don't want it to redirect to git@github.com.example.com)

Best Answer

The option you're looking for is CanonicalizeHostname.

If you add these to the top of your .ssh/config, ssh internal will try to dns resolve your entry speculatively as internal.example.com, and if successful, it will process it matching Host *.example.com. The CanonicalDomains line can have multiple entries that are tried in order.

CanonicalDomains example.com
CanonicalizeHostname yes
Related Topic