Connect through jump hosts and proxies

When a server cannot be reached directly, Sternway can pass through other servers on the way (jump hosts, also called bastions; ssh calls this ProxyJump), go through a proxy, knock on its firewall first, or wake it up.

Add jump hosts

1. Save each jump host as a host of its own, with its own login, in the same vault as the target.
2. Open the target host’s editor, open Advanced, and under Host chain (jump hosts) choose Add a jump host for each server to pass through, in order.
3. Save.

When you connect, Sternway logs in to the first jump host with its own saved login, tunnels through it to the next, and so on to the target. Up to 8 hops. Every hop’s host key is checked like any connection’s. If the first jump host has jump hosts of its own, they are passed through too.

Each jump host can see where you connect next. Port forwards, SFTP and tmux sessions to the target go through the same chain.

For many hosts at once: set the chain on a group. Every host in it that has no chain of its own uses the group’s.

One-off: type an ssh command with -J into Quick connect, such as ssh -J admin@bastion.example.com app@10.0.0.5.

From ~/.ssh/config: ProxyJump lines become the host’s chain when you import or link the file (Import hosts).

Go through a proxy

In the host editor under Advanced, set Proxy to SOCKS5, SOCKS4 or HTTP, and fill in Proxy host, Proxy port (1080 is filled in; HTTP proxies often use 3128 or 8080) and, if the proxy asks, Proxy username and Proxy password.

• An HTTP proxy is asked to open a tunnel with CONNECT, so it must allow that for the server’s port. It receives its password with only basic encoding.
• With jump hosts, the proxy carries the connection to the first jump host only.
• A ProxyCommand from your own linked ~/.ssh/config is run as ssh would run it (desktop only). It is never imported or synced.

Knock before connecting

For a server whose firewall keeps the SSH port shut until it sees a sequence of connection attempts (knockd and the like), fill in Port knocking under Advanced: the ports in order, separated by spaces, with :udp after a UDP one (7000 8000:udp 9000). Sternway knocks before every connection. Behind a jump host the jump host knocks, and only with TCP.

A knock sequence is not a password: anyone watching the network can see it.

Wake the host first

For a machine that sleeps or is switched off with Wake-on-LAN enabled in its firmware, fill in Wake-on-LAN MAC address. The host then has a Wake (Wake-on-LAN) action. Turn on Wake before connecting to send the packet on every connection and wait until the SSH port answers. The packet goes out from your device on the network it is on, so it reaches machines on the same local network, or on another subnet whose router forwards it (set Wake-on-LAN broadcast address to that subnet’s broadcast address).

Limits

• Mosh cannot be used through jump hosts or a proxy: Mosh speaks UDP straight to the target. Turn Mosh off for such a host (Use Mosh).
• Telnet ignores jump hosts.
• A host behind a jump host or proxy is never checked by the reachability dots or Wake before connecting; Sternway only waits.