Prevent SSH Session Eavesdropping through a Bounce Host

Question

In order to access a Linux host through a firewall/NAT I am required to use an SSH "bounce host". I am concerned with the possibility that this bounce host may be logging my SSH session. In a test environment I am able to log anything that is displayed on the console, including screen sessions.

What steps can I take to ensure that my SSH session will be secure/private if this bounce host does indeed perform logging?

Why would you even have an interactive session on the bounce host, instead of just tunneling through it? — andol, Jan 07 '14 at 23:05
No not the admin and the only way to access is using IPv4 and the bounce host. — Tuaris, Jan 14 '14 at 21:14

score 0 · Answer 1 · edited Apr 13 '17 at 12:14

It depends on how exactly you are using this bounce host.

If you use ProxyCommand, or Netcat mode (in OpenSSH 5.4+) there are basically two separate encrypted connections. One between you and the bounce host, and a completely separate connection between your local client and the far host. In this mode the only thing the intermediate host would know is that you ran where using it as a proxy.

If on the other hand you are just connecting to the intermediate host, and then launching an ssh connection from that host to the far host, then yes, potentially everything you do could be monitored.

Prevent SSH Session Eavesdropping through a Bounce Host

1 Answers1