SSH through a jump host (bastion) with SheepTerm

What a jump host does

A jump host (bastion) is an SSH server you can reach, which in turn can reach devices you cannot. SheepTerm logs into the bastion, asks it to open a tunnel to the target, and then runs a second SSH session to the target through that tunnel. Nothing is installed on the bastion, but it must allow TCP forwarding (AllowTcpForwarding in OpenSSH).

In OpenSSH terms this is the same as:

ssh -J [email protected] [email protected]

The examples on this page use documentation addresses: 192.0.2.10 is the bastion and 198.51.100.20 is the device behind it.

Set it up

1. Open the host formChoose File › New SSH Connection… (⇧⌘N) for a one-off, or edit an existing saved host with Edit Host.
2. Fill in the targetEnter the device behind the bastion (198.51.100.20), its port and username as usual.
3. Fill in “Via jump host”Type user@host or user@host:port (for example [email protected]), or use the menu beside the field to pick a host you have already saved. Picking a saved host fills in its user@address. Leave the field empty for a direct connection.
4. ConnectSheepTerm connects to the bastion first. The sign-in card in the tab shows each step: connecting, host key, username and password.

How it behaves

• One hop. A single bastion is supported. A saved host that itself uses a jump host is not offered as a bastion.
• Host keys are checked for the bastion and the target. You are asked to trust each unknown key, the same way as for a direct connection: Trust & Connect, Connect Once, or Cancel.
• Credentials are kept apart. A password that works for the bastion is remembered for the bastion only; it is not reused for the target.
• Bad input does not silently go direct. A malformed bastion shows a red line under the field and disables Connect; a saved bastion that has since been deleted gives a message in the tab.
• Typed bastions travel with exported hosts. A typed user@host is included when you export a group to a .sheepterm file. A reference to a saved host is not, because the other machine has different hosts.
• ~/.ssh/config is not read. SheepTerm deliberately ignores it, so a ProxyJump line there has no effect. Set the jump host on the host entry instead.

If it fails

• It stops at the bastion. Check that you can log in to the bastion directly, and that its SSH server allows TCP forwarding.
• It reaches the bastion but not the device. The bastion must be able to reach the target’s address and port from its own side of the network. Test with ssh from the bastion.
• Several hops. Chains longer than one bastion are not supported.

SheepTerm’s jump support has been tested against a throwaway SSH server and against a real bastion in the author’s lab.

On Windows

SheepTerm for Windows has the same Via jump host field in its New SSH Connection and Edit Host forms, and the same one-hop rule.

Related

• USB serial console on a Mac
• Log and search network device sessions
• Vendor highlighting for CLI output
• Compare SheepTerm with other terminal clients