SSH passthrough?

Question

I borrow the word "passthrough" from GPU passthrough in virtual machine because the concepts sound similar to me, at least from usage point of view. Here I have a QEMU MV, both host and guest being ubuntu 20.04. I use port forwarding to ssh from host into guest:

ssh localhost -p5555

Now I have a second host, also running ubuntu 20.04. Suppose the hostname of the machine containing QEMU MV is host1, while the hostname of the second host is host2. host2 can ssh into host1 using normal ssh command. My question is: how to use a single ssh command to connect host2 to the guest OS? Assume the user names are all the same on host1,host2 and guest: myname. Since under port forwarding, host1 uses localhost to specify the guest VM, not its hostname, so I don't know how to write the ssh command.

I tried ssh myname@host1 -p5555 on host2 but ssh does not return. Instead, it behaves like a command-line editor. The guest is on. So, what option can I use to let a single ssh command to connect from host2 into the guest OS? Thanks.

Answer 1

The chain to do is host2 -> host1 -> localhost:5555.

The -J option allows easily to do this from host2 using the -J / ProxyJump feature:

-J destination

Connect to the target host by first making a ssh connection to the jump host described by destination and then establishing a TCP forwarding to the ultimate destination from there.

[...]

So without yet considering the option for port 5555:

ssh -J host1 localhost

Also as documented right after...

Note that configuration directives supplied on the command-line generally apply to the destination host and not any specified jump hosts. Use ~/.ssh/config to specify configuration for jump hosts.

...extra options like specifying a port don't affect the Jump Host but will only affect the final target. Just add back the port option:

ssh -p 5555 -J host1 localhost

You could even have different users on all 3 systems and specify the user names in the command:

ssh -p 5555 -J myhost1user@host1 myvmuser@localhost

Note: Each ssh server requires its own separate authentication. If you don't use features to avoid having to provide passwords like by using ssh keys, you will probably be asked twice in a row a password: once for connecting to host1, once for connecting to the VM behind localhost:5555.