Bastion access issues with ProxyCommand and ProxyJump

[redsux]

Hello,

I searched in discussions & issues but didn't find anything relevant so let's start a new thread.

Proxy Issues

I'm facing an abnormal behaviour recently with Blink on iPad and iPhone.
Any attempts to use a bastion are failing.

• Blink v17.2.1.866
• iPadOS 17.3.1

Errors with ProxyCommand :

blink> ssh -vvvv host
Setting up connection callbacks.
Starting connection to my.host.domain
ssh_connect: libssh 0.9.8 (c) 2003-2021 Aris Adamantiadis, Andreas Schneider and libssh contributors. Distributed under the LGPL, please refer to COPYING file for information about your rights, using threading threads_pthread
ssh_socket_connect_proxycommand: Executing proxycommand 'ssh -W my.host.domain:22 my.bastion.domain'
ssh_socket_connect_proxycommand: ProxyCommand connection pipe: [22,23]
socket_callback_connected: Socket connection callback: 1 (0)
ssh_client_connection_callback: session_state=2
ssh_connect: Socket connecting, now waiting for the callbacks to work
ssh_connect: current state : 2
ssh_socket_exception_callback: Socket exception callback: 1 (0)
ssh_socket_exception_callback: Socket error: disconnected
ssh_client_connection_callback: session_state=9
connError(msg: "Session Exception - Socket error: disconnected")
Starting connection to my.host.domain
ssh_connect: current state : 9
Error connecting t

Errors with ProxyJump :

blink> ssh -vvvv host
Setting up connection callbacks.
Session deinit
Error connecting to host. operationError(msg: "Failed to set option \'SSH_OPTIONS_PROXYJUMP\'")

Tests with another tool

There is no weird configurations, my ssh -J bastion host is working fine in my MacOS Terminal.

I also tried with another tool (Secure ShellFish with free unlocked pro trial) without any issues.
The ProxyJump is working fine.

Thanks

Thank you in advance for any ideas/suggestions explaining this connError(msg: "Session Exception - Socket error: disconnected") or operationError(msg: "Failed to set option \'SSH_OPTIONS_PROXYJUMP\'").

[carloscabanero]

Hi! Thanks for reaching out. These are usually configuration issues. Can you send me the configuration from .blink/ssh_config file?

Two things to try, because the bastion is killing the connection:

• In a different shell, run 'ssh -W [host]:22 bastion'. It should stay connected and blank. If it disconnects, then add -vvvvv so we can see what is going on.
• Does the Files.app integration work? We use a different method to do the jump and that would point me on a direction for the fix.

Similar issues: #1868 and #1840

Send me that and I can continue taking a look from our side.

[carloscabanero]

So unfortunately I haven't been able to replicate the issue and I think this may still be a configuration or parsing problem somewhere:

• From your first error message (running with ProxyCommand), I can see Blink could not connect to the jump host, "my.bastion.domain". I can replicate this error if I misconfigure the connection (wrong user or key). That is why connecting there first separately gives us more insight to debug what is going on, and now it seems like that works.
• On SSH_OPTION_PROXYJUMP. This one I have never seen. The error comes from LibSSH when configuring the flag. Does that host you are using have any special number of dots or other stuff that maybe you cleaned before sharing? If you do -J, do you have the same issue? How about using -J to a different host you can connect to, do you get that error consistently?
• Note that when configuring ProxyJump, you do not need to ForwardAgent. I assume you want that to access the keys in the final machine (in that case you only need it there). I tested anyway in case these flags maybe triggered the issue and this shouldn't have any impact, everything should have gone through.

Now let me describe the way I ran my tests, in case you see some differences with your configuration:

• Two machines in DigitalOcean. The Jump host has in /etc/hosts the local IP configuration to the final machine final_machine internal_ip.
• I tried connecting from CLI without hosts defined (ssh -J root@jump_host_ip root@final_machine). All good.
• Then I defined the hosts inside Blink, first just with final_machine.domain. Then I created jump_host.domain as well. All good.
• I then forwarded the Agent first in the final connect (the agent went through correctly even if the jump host didn't have it, as expected). Then I enabled it on both, just to make sure there were no issues there. All good as well.
• And then I broke it in different places just to try to replicate your error message. When messing up with the jump host connection I could replicate the Socket error: disconnected. I could not replicate the SSH_OPTIONS_PROXYJUMP in any scenario.

Hope this helps give you more information as well and we can figure out what exactly is going on.

[redsux]

Thank you for all your test !
All my connections with ProxyJump work well on MacOS, Debian and even Windows so I do not understand why it's not working with Blink...

At least, the ProxyCommand is now working fine 👍
BTW : I'm forwarded my ssh-agent on the bastion as I'm also using it directly !

Again thank you

[carloscabanero]

Had this in my back burner for the weekend to see if something came up. ProxyJump isn't different than ProxyCommand - it gets transformed internally into ProxyCommand. The issue with ProxyJump here is while parsing the hostname you are passing to it. Are you using a special hostname or any special characters? Cannot think of any other reason why this wouldn't get transformed.

But in any case, if instead of ProxyJump the equivalent ProxyCommand works for you, at the end of the day it is the same thing. Just wanted to see if there is anything we could replicate and improve on libssh itself.

[redsux]

No weird character except some - (i.e. 3lc-z0x-name.company.org ) so it shouldn't have any impact.
And ProxyJump works well in my MacOS' Terminal (same kind of ssh_config, just adding some persistent sockets to reuse connexions).

As you said, as long as ProxyCommand works I'm fine !
Using my iPad is still some edge cases in my workflow so as long as I've a working solution it's good for me 👍

Really a weird behaviour 🤔

[carloscabanero]

Thanks! Yeah, not saying it is an issue with ProxyJump in general, this should definitely work in OpenSSH. But, Libssh has a host parsing piece for the ProxyJump parameter, and I’m wondering if there is anything there failing or not working the way it should. I will try something like what you sent and see if I can trigger it! Thanks for the extra info.