ProxyCommand support

[igorwwwwwwwwwwwwwwwwwwww]

This is a feature request.

I was trying to use katyusha, but was not able to get it working due to missing ProxyCommand support. We are relying on ProxyCommand to proxy through a bastion host.

The result was something along these lines:

$ katyusha run 'api-*' env=prod -- hostname

20000 done, 0 ok, 0 fail, 20000 error in 0s
hostname
api-01.prod.internal      dial tcp: lookup api-01.prod.internal: no such host after 0s
api-02.prod.internal      dial tcp: lookup api-02.prod.internal: no such host after 0s
...

Using roughly this kind of ssh config:

Host *.prod.internal
  ProxyCommand bash -c "ssh bastion.prod.example.com -W %h:%p"

The bastion host is used not only to proxy the connection, but also for DNS resolution of the target hostname.

[igorwwwwwwwwwwwwwwwwwwww]

Note: this should probably by replaced by ProxyJump -- so support for ProxyJump would do the trick as well. :)

[seveas]

Yeah, that's been on my wishlist ever since I started. However, it's not easy to do as one cannot tunnel all connections through the same ssh connection to the proxy (there's a hardcoded limit of 10 simultaneous forwarded things). So you'd need a lot of connections to the proxy, which it may not like and it also introduces a lot of overhead. Or you would need some custom proxying thing installed on the proxy host that's started via ssh and does all the coordination there.

However, the latter introduces the problem of the ssh agent being slow when accessed remotely. If you try it now by installing katyusha on that bastion host and using a forwarded agent (ssh -A), you will find that it is very slow.

So for now the easiest way is a VPN connection between your local machine and the datacenter.

[terrorobe]

there's a hardcoded limit of 10 simultaneous forwarded things

It looks like this is configurable these days:

MaxSessions
Specifies the maximum number of open shell, login or subsystem (e.g. sftp)
sessions permitted per network connection.

Or are forwarded connections treated differently?

---

Thinking out loud, I'm wondering if a Socks Proxy SSH connection using -D to the jump host could be used by katyusha more easily instead, as an alternative to VPN infrastructure which may or may not exist.

[seveas]

Forwards are done differently, and sadly the socks forward as well. And even if they weren't, changing the sshd configuration to accomodate katyusha is something that will not always be possible, and thus I'd like to avoid it.