How can I use Emacs Tramp to double hop ssh?

Question

My campus only lets ssh access through a gateway server. So to access the cluster I am coding on I have to ssh to the gateway and then ssh to the machine I am working on. The connection is very slow at times and is frustrating to work on.

I would love to use something like tramp which I understand would have the buffer open on my local machine and only talk through the network when I save to disk. I am not very familiar with tramp at all and struggling to get it to work, especially through the double hop. The documentation says this is accomplished through defining proxies in tramp, but I am unable to understand the syntax.

Does anyone know how to use emacs to code through a double hop or have an alternate workaround for editing code through two ssh hops?

Scintillation

It might help if you could explain what exactly you don't understand about the documentation: gnu.org/software/tramp/#Multi_002dhops – Huron

Answer 1

If you have Emacs 24.3 or later, see Joe's answer for an alternative to the configuration described below. If you'll be using this double hop more than once, it may be worth either modifying tramp-default-proxies-alist as described below, or setting tramp-save-ad-hoc-proxies to t.

---

If you have Emacs 23.1 or later, then the multi method is no longer supported. You can achieve the same result by configuring "proxies".

In your .emacs config file add the following:

(add-to-list 'tramp-default-proxies-alist
                 '("HOSTB" nil "/ssh:USERA@HOSTA:"))

Where HOSTB is the destination host behind HOSTA.

Then type /ssh:USERB@HOSTB: and emacs will prompt for the HOSTA password then the HOSTB password.

Jonna

Any idea why multi has been removed? It was awesome :( – Statement

I believe that Tom's pointing out that the functionality is still there, just in a different form. It's sad that it's harder to do it ad-hoc, but it's not gone. – Lyricist

In emacs 24 you can use pipes, example: /ssh:bird@bastion|ssh:you@remotehost:/path (see docs: gnu.org/software/tramp/#Ad_002dhoc-multi_002dhops) – Abm

can it make one hop authentication with password and another with private key? – Quentinquercetin

Answer 2

At least as of Emacs 24 they have a new version of multi you can open paths like this:

   /ssh:bird@bastion|ssh:you@remotehost:/path

I can confirm that this works on my version of Emacs 24.3.1. The docs describe it here.

Abm

Also be aware of the potential traps when using this syntax with the su: and sudo: methods: https://mcmap.net/q/174039/-open-file-via-ssh-and-sudo-with-emacs – Hiltner

Confirm works on Emacs 26.1 on macOS 11.1 – Jakob

Answer 3

You should use ssh to do the double hop. In your .ssh/config:

Host <host that must be proxied too>
ProxyCommand ssh -qxT <gateway host> nc %h %p

Verjuice

I have never gotten that to work. I trid it just now and it prompts me for my password on the gateway and says: "ssh_exchange_identification: Connection closed by remote host" Then quits – Scintillation

Keep in mind that you'll need netcat installed on the hop machine. However, you should be able to compile it yourself and keep it in ~/bin/ You may have to put the full path in the proxycommand (... /home/yourname/bin/nc %h %p) – Ramunni

Oh, and keep in mind that this will work best if you have keys set up, or you'll end up typing your password a lot (i.e. twice per login). – Ramunni

Yeah, this works for my other applications, but isn't working with Emacs 29... – Foredeck

Answer 4

In earlier Emacs versions, Tramp had a multi method. On GNU Emacs 22 and below, you could use it like this:

/multi:ssh:user1@host1:ssh:user2@host2:/foo/bar/baz

to open /foo/bar/baz on host2. The same thing is possible on XEmacs, but with a somewhat different syntax. You can use different access methods, too.

Speechmaker

multi doesn't work using this for me. Hasn't it been removed in recent versions of Emacs? – Statement

How recent? I am using Emacs 22.3 on Debian/unstable boxes and it works just fine. – Speechmaker

They took out the support. I tried it on GNU Emacs 23.2.1 (i686-pc-cygwin, GTK+ Version 2.18.6) and got: "tramp-dissect-file-name: `multi' method is no longer supported, see (info "(tramp)Multi-hops")." – Forequarter

Answer 5

Using @fuzzy-waffle 's idea,

a complete config would look like this:

Host servera
  Hostname servera.lan.local
  User servera-user
  ProxyCommand ssh gateway-server -W %h:%p

Add your ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub to ~/.ssh/known_keys on the servera.

In the end you can run C-x C-f /ssh:servera:~/abc.txt

Infinitive

I already had this set up and works in terminal and in other applications, but Emacs still prompts me for passwords twice... – Foredeck

Do you have tramp specific config in Emacs? Or ssh specific ones? Try removing them? – Infinitive

No tramp specific or ssh specific configs; in any case, I get the same behavior after launching with the -q option. ssh'ing in using the terminal I have no problem; same thing when I use Sequel Ace. – Foredeck

I can't think of anything, are you using a special operating system that uses some kind of jails/sandbox? – Infinitive