PuTTY wish ssh-proxy-remote-command

This is a mirror. Follow this link to find the primary PuTTY web site.

summary: Proxying via an SSH jump host by running a remote command
class: wish: This is a request for an enhancement.
fixed-in: 6f7c52dccee36f6593a3fa4498ce1cc5d9952c66 (0.78)

PuTTY 0.77 introduced the feature of proxying a network connection over a secondary SSH session, by means of connecting to a proxy SSH server and asking to open a direct-tcpip channel to the ultimate endpoint. (This is the same way that plink -nc operates, and also the same thing done by OpenSSH if you use its corresponding -J and -W options.)

We've now extended this further, by adding the option to ask the SSH server to run a particular command, instead of making a TCP connection directly. So if you can only contact your destination server by SSHing to a proxy host and having that host run a complicated command to make the connection, then now you can set that up conveniently in PuTTY.

Put another way: where the previous SSH proxying feature was a more convenient alternative to configuring plink %proxyhost -nc %host:%port as a local proxy command, the new one is an alternative to configuring plink %proxyhost some-totally-different-command.

A few examples of why this might be useful:

The IP address of the destination server is only known to the proxy host, and by some method less convenient than the DNS, so the remote proxy command has to look up where to connect to before making the connection.
The network connection has to be forwarded over some networking system other than TCP/IP, and only a command-line tool on the proxy server knows how to do that.
The proxy server has to perform an auxiliary handshake, such as port knocking or bringing up a VPN link, before it can make the connection.

The new feature also permits you to invoke an SSH subsystem of your choice, as well as a command. However, the interaction with the subsystem is expected to consist of only the forwarded network traffic, with no prior handshake signalling the destination host. So this will only be useful if you've already configured a subsystem that connects to that specific host, or if your server supports a whole family of subsystems which have the host and port baked into the subsystem name.

If you want to comment on this web site, see the Feedback page.

Audit trail for this wish.

(last revision of this bug record was at 2022-09-10 09:55:46 +0100)