ProxyCommand in SSH

Question

linux

Good evening. Stuck on ProxyCommand SSH option. I can't figure out exactly how it works.
So, as an argument to this option, we specify a specific command. Please explain where exactly this command is called, on the client or on the server. What is being fed to it on stdin, and where is its stdout directed to. In general, as detailed as possible.

Answer 1

ssh receives the data received by the "out of port" command (comes from the command's stdout). In turn, ssh writes commands to stdin

That's right.
For example corkscrew is used as a ProxyCommand to connect via ssh from behind an http proxy.

Answer 2

So, I decided to check what was going on with the pipes there (it's hard to say "pipes").
We start ssh, without specifying the ProxyCommand option:

ssh [email protected]

In the next tab of the terminal, we look, we are trying to open all the pipes opened by the process:

lsof | grep -E "^ssh.*FIFO"

And nothing, emptiness. Not surprising, we don't write anything to stdin. Let's try to write something:

pv /dev/zero | ssh [email protected] "cat > /dev/null"

The progress bar is moving, go to the next tab, and again try to thaw

lsof | grep -E "^ssh.*FIFO" 

In response we get:

ssh 23782 svon 0r FIFO 0.8 0t0 2401849 pipe
ssh 23782 svon 4r FIFO 0.8 0t0 2401849 pipe

So, great, ssh reads from stdout (0r), and from somewhere else (4r). At this point, it's still interesting to see what TCP connections ssh uses. We thaw over TCP:

lsof | grep -E "^ssh.*TCP" 

At the output we get:

ssh 24344 svon 3u IPv4 2432025 0t0 TCP arch:59472->super-vps.hell:ssh (EST.)

Next, run ssh in conjunction with netcat ( ProxyCommand )

ssh -o "ProxyCommand nc %h %p" [email protected]

We go to the next tab and again we grab, but only already and netcat too:

lsof | grep -E "(^ssh|^nc).*FIFO" 

And what do we get out of it?

ssh 24899 svon 4w FIFO 0.8 0t0 2449781 pipe
ssh 24899 svon 5r FIFO 0.8 0t0 2449782 pipe
nc 24900 svon 0r FIFO 0.8 0t0 2449781 pipe
nc 24900 svon 1w FIFO 0.8 0t0 2449782 pipe

And here's what. And if we look closely at the node numbers, we will notice.
What does 4w (ssh ?) write to 0r (netcat stdin) and 5r (ssh ?) read from 1w (netcat stdout).
Forgot to check connections. We fix:

lsof | grep -E "(^ssh|^nc).*IPv4" 

And we end up with:

nc 24900 svon 3u IPv4 2449789 0t0 TCP arch:59476->super-vps.hell:ssh (EST.)
 

We see that out of our 2 programs, there is only one connection, it belongs to netket.
If you look at the ssh startup log (with -vvv options), you can see that everything is perfectly encrypted, and in general, there is peace all over the world.
Based on the facts that I cited above, I dare to be sure that everything works exactly according to the scheme I assumed (even higher).
What does this allow us to do? In general, a lot of things, but it was interesting for me to forward the ssh tunnel through the tor to my VPS. What for? At least because it's cool. Thanks for reading, looking forward to more.