jump through two bastion hosts?

[Eric Hymowitz]

So I've got a host that I need to jump through two bastion hosts to get to:

Ansible ----->  bastion_1 -----> bastion_2 -----> target

I can use ansible to get to bastion_2 by setting up a hostvar:

ansible_ssh_common_args: -o "ProxyCommand=ssh -q -W %h:%p {{local_user_account}}@bastion_1"

...and that works correctly.

I tried setting up a similar hostvar for target:

ansible_ssh_common_args: -o "ProxyCommand=ssh -q -W %h:%p {{local_user_account}}@bastion_2"

...but that doesn't work, because ansible is trying to ssh directly to bastion_2 and not caring about the hostvar set up to access bastion_2.

I have a workaround.  I can set up an entry in my ~/.ssh/config file

Host bastion_2
       ProxyCommand ssh -q -W %h:%p bastion_1

... and then ansible works, because ansible tells ssh to go through bastion_2, and ssh figures its own way there.

But is there a way to do this just within ansible, without using .ssh/config ?

--EbH

PS -- my ssh is too old for the -J / ProxyJump option, which I think would solve my problem.

[Kai Stian Olstad]

On Wed, Feb 19, 2020 at 12:06:21PM -0800, 'Eric Hymowitz' via Ansible Project wrote:
> So I've got a host that I need to jump through two bastion hosts to get to:
>
> Ansible -----> bastion_1 -----> bastion_2 -----> target
>
> I can use ansible to get to bastion_2 by setting up a hostvar:
>
> ansible_ssh_common_args: -o "ProxyCommand=ssh -q -W %h:%p
> {{local_user_account}}@bastion_1"
>
> ...and that works correctly.
>
> I tried setting up a similar hostvar for target:
>
> ansible_ssh_common_args: -o "ProxyCommand=ssh -q -W %h:%p
> {{local_user_account}}@bastion_2"
>
> ...but that doesn't work, because ansible is trying to ssh directly to
> bastion_2 and not caring about the hostvar set up to access bastion_2.

There is nothing stopping you from adding -o ProxyCommand in the ssh inside
the ProxyCommand.

So something like this might work

ansible_ssh_common_args: -o "ProxyCommand=ssh -o 'ProxyCommand=ssh -q -W %h:%p user@bastion_1' -q -W %h:%p user@bastion_2"

You may need to play around with the single and double quotes and escaping some of them.


--
Kai Stian Olstad