How do I configure ssh to automatically port forward to another computer?

Question

I found the permit_open option in authorized_keys, but I want the particular user to ssh to the server and automatically telnet to another user and being jail-boxed at the same time. It means something like:

user1@local# ssh user1@remote1

it actually connects to a remote2 telnet port behind a firewall, and user1 is not able to access anything(incl. remote1) behind the firewall.

Answer 1

You would use port forwarding, or a firewall rule (ipchains, or similar). I think you're looking at SSH expecting to do this, but that's not what SSH is for.

Answer 2

I would not use port forwarding but simply change the initial program run by the ssh user on remote1 to be "telnet remote2" instead of "/bin/bash" or whatever. EDIT : with the "command" option in authorized_keys

Maybe you could elaborate on your use case, though.

Answer 3

Renik already gave you the answer, but do not forget to add some hardening settings to disable port forwarding.

Like this :

command="/usr/bin/ssh user1@remote1",no-port-forwarding,no-user-rc ssh-rsa ... user@host

Answer 4

Leaving aside the user of telnet in a secure environment, I agree with Harv - you're trying to overload SSH. If it were my build, I'd probably put in openVPN for the remote users to connect to remote1, then use iptables to restrict traffic coming out of the tunnel to TCP/23 destined for remote2 (and replies).