Bug 3324 - SSH client does not use correct user when ProxyJump option specified
Summary: SSH client does not use correct user when ProxyJump option specified
Status: CLOSED WORKSFORME
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: 8.6p1
Hardware: amd64 Linux
: P4 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-06-22 17:12 AEST by Jordan
Modified: 2022-02-25 13:57 AEDT (History)
1 user (show)

See Also:


Attachments
ssh test@visor.home debug log (8.88 KB, text/plain)
2021-06-22 17:12 AEST, Jordan
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jordan 2021-06-22 17:12:29 AEST
Created attachment 3529 [details]
ssh test@visor.home debug log

When using 'ssh test@visor.com'
           or 
           'ssh visor.com -o User=test'

With the following ssh_config, the user is instead set to the current user instead of the user specified user. 

E.g 

If my user is "bob" and I do 'ssh test@visor.home', the user that will be used for authentication for both the jump host and for the target is "bob" instead of "test".

Host gateway.bastion
        ControlMaster auto
        ControlPath /tmp/bastion-%r@%h:%p
        ControlPersist 10m      
        IdentityFile ~/.ssh/id_ed25519
        Port 4343
        HostName example.com


Host *.home
        Port 4343
        IdentityFile ~/.ssh/id_ed25519
        ProxyJump gateway.bastion

Host visor.home
        HostName 10.0.0.3
Comment 1 Damien Miller 2021-08-27 13:49:09 AEST
> If my user is "bob" and I do 'ssh test@visor.home', the user that 
> will be used for authentication for both the jump host and for >
> the target is "bob" instead of "test".

It's definitely intended that the default user ("bob" here) would be used to authenticate to the ProxyJump host, because that hasn't been overridden anywhere. Note that that a non-default destination username is deliberately *not* used automatically for the jump host - you need to specify it explicitly, either on the ProxyJump commandline/directive (ProxyJump user@host) or in the Host/Match block for the jump host in your config.

It's not intended that the default user would be used to authenticate to the destination host when another is specified on the commandline. However, I can't replicate the behaviour you're seeing however: when I try a modified version of your config the destination uses the user specified on the commandline.
Comment 2 Damien Miller 2022-01-14 15:22:56 AEDT
Closing for lack of followup
Comment 3 Damien Miller 2022-02-25 13:57:57 AEDT
closing bugs resolved before openssh-8.9