# SSH via Jumpbox **URL:** \ **Category:** Ansible Project\ **Created:** [February 3, 2015, 10:26am UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431 "2015-02-03T10:26:31Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Ethan\_Zhan](https://avatars.discourse-cdn.com/v4/letter/e/3da27b/32.png) [@Ethan\_Zhan](https://forum.ansible.com/u/Ethan_Zhan)\ **Post date:** [February 3, 2015, 10:26am UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/1 "2015-02-03T10:26:31Z")
Hi, I’m in trouble with how to use ansible on jumpbox, here is the issue. from jumpbox I have to use command **sudo ssh box\_ip** to get login with root permission. How can I let ansible know to use sudo ssh instead of ssh command to execute ? Thanks Ethan ---
**Author:** ![michael1](https://avatars.discourse-cdn.com/v4/letter/m/eada6e/32.png) [@michael1](https://forum.ansible.com/u/michael1)\ **Post date:** [February 3, 2015, 2:19pm UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/2 "2015-02-03T14:19:00Z")
As Ansible will work with your ssh config file (~/.ssh/config), have you tried this: ` #~/.ssh/config Host \* ProxyCommand sudo ssh -W %h:%p remote\_proxy\_system ` ```auto ``` ```auto This will proxy ALL systems via the proxy server, using the 'sudo ssh' command. If you don't want it to proxy everything, then you need to replace '*' with a space separated list of remote hosts to match. ``` ---
**Author:** ![michael1](https://avatars.discourse-cdn.com/v4/letter/m/eada6e/32.png) [@michael1](https://forum.ansible.com/u/michael1)\ **Post date:** [February 3, 2015, 2:20pm UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/3 "2015-02-03T14:20:53Z")
Actually scrap that, I misunderstood the use of that command. That won’t work (and will run sudo locally) ---
**Author:** ![Chris\_Short](https://avatars.discourse-cdn.com/v4/letter/c/ac8455/32.png) [@Chris\_Short](https://forum.ansible.com/u/Chris_Short)\ **Post date:** [February 3, 2015, 5:32pm UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/4 "2015-02-03T17:32:17Z")
That is going to trigger ssh as root. Is ssh usage restricted to root only on the jumpbox or are you just trying to ssh to another system as the root user (in which case ssh -l root 1.1.1.1 would work)? ---
**Author:** ![Ethan\_Zhan](https://avatars.discourse-cdn.com/v4/letter/e/3da27b/32.png) [@Ethan\_Zhan](https://forum.ansible.com/u/Ethan_Zhan)\ **Post date:** [February 4, 2015, 2:14am UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/5 "2015-02-04T02:14:05Z")
The jump box restricted only root can ssh to another system with ssh key pairs, common user use sudo ssh do the same thing. ---
**Author:** ![Thomas\_Oliw](https://avatars.discourse-cdn.com/v4/letter/t/f6c823/32.png) [@Thomas\_Oliw](https://forum.ansible.com/u/Thomas_Oliw)\ **Post date:** [January 11, 2017, 3:59pm UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/6 "2017-01-11T15:59:14Z")
Hello, I know this is an old thread, but I have exactly the same problem as Ethan. In our environment, we juse a jump host to access servers. This is a very hardened and stripped down linux/unix server. The only way to become root on your server-to-manage is to ssh with your username to the jumphost and then issue a “sudo ssh server-to-manage”. I can accomplish this in one ssh command with this: ```auto ssh -tt jumpserver "sudo ssh server-to-manage" ``` ```auto ``` ```auto Question is how do you accomplish that in Ansible?! ``` ```auto ``` ```auto Any advice is much appreciated. ``` ```auto ``` ```auto Kind Regards, ``` ```auto ``` ```auto Thomas ``` ```auto ``` ---
**Author:** ![Dick\_Davies](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Dick\_Davies](https://forum.ansible.com/u/Dick_Davies)\ **Post date:** [January 11, 2017, 7:59pm UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/7 "2017-01-11T19:59:54Z")
So you all use roots private key on the jumpbox to access the protected servers? Forgive me but that seems a bit backwards - you lose audit trail for the servers being accessed, since you're all logging in with the same private key (i.e. roots key on the jump host). We generally ssh to our jump boxes as non-root users and then ssh again to the backend servers from non-root accounts on the jump box. I know that's not really answering your issue, but I'm curious which one of us is doing the unusual thing 🙂 ---
**Author:** ![Thomas\_Oliw](https://avatars.discourse-cdn.com/v4/letter/t/f6c823/32.png) [@Thomas\_Oliw](https://forum.ansible.com/u/Thomas_Oliw)\ **Post date:** [January 12, 2017, 8:40am UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/8 "2017-01-12T08:40:37Z")
Hi Dick, Well, I have no insight in why this model was choosen. I guess that it allows strict control to limit all accesses via one hardened jumphost, and only one place to manage sudo stuff. I will try to go the correct route and ask the security people why the jumpstation is built the way it is, but I fear it will take some time… Still worth the struggle if it allows us to automate tasks in a safe and efficient way in the future. (If there are good documentation on how to build a ssh jumphost, I am interested to read up on that). Meanwhile, the work on my desk remains and I was hoping to find a way to let Ansible do some of the heavy lifting allowing us to use the current infrastructure to get work done. If anyone has a solution to this I am keen to learn. Kind Regards, Thomas ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [January 12, 2017, 10:08am UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/9 "2017-01-12T10:08:55Z")
I doubt that ansible is capable of handling this kind of jumphost. A 'normal' jumphost that just forwards the connection and the ssh key works outside of ansible and does not require much configuration (mostly setting the hosts up in your ~/.ssh/config). > Well, I have no insight in why this model was choosen. I guess that > it allows strict control to limit all accesses via one hardened > jumphost, and only one place to manage sudo stuff. I will try to go > the correct route and ask the security people why the jumpstation > is built the way it is, but I fear it will take some time... Still > worth the struggle if it allows us to automate tasks in a safe and > efficient way in the future. (If there are good documentation on > how to build a ssh jumphost, I am interested to read up on that). I would be curious why this setup was chosen. If your are not doing smart sudo authentication, then your whole setup depends on users entering their password to do 'sudo ssh ...'. Or worse, all enter the same root password. So I can not see any advantages over authenticating via ssh keys on the target host. Johannes ---
**Author:** ![Thomas\_Oliw](https://avatars.discourse-cdn.com/v4/letter/t/f6c823/32.png) [@Thomas\_Oliw](https://forum.ansible.com/u/Thomas_Oliw)\ **Post date:** [January 13, 2017, 2:58pm UTC](https://forum.ansible.com/t/ssh-via-jumpbox/17431/10 "2017-01-13T14:58:13Z")
Hi Johannes, Thanks for your reply. I am much of the same opinion after some fruitless attempts. It probably is not possible to achieve what I need directly with Ansible/ssh. Sad, but I’ll find some other way to work. As why this solution was choosen, I cannot say. It’s what we got to work with from joint effort of security- and OS team (I work in application support). I can only guess that having one point of access in combination with one place to manage sudo rights is the reason. Best Regards, Thomas