What is the difference between ssh proxycommand -W, nc, exec nc

ssh

Solution

Here's how I understand it:

`ProxyCommand ssh proxyserver -W [%h]:%p`

The `-W` option is built into new(er) versions of OpenSSH, so this will only work on machines that have the minimum version (5.4, unless your distro back-ported any features; e.g., RHEL6 OpenSSH 5.3p1 includes this feature). Per the release notes: http://www.openssh.com/txt/release-5.4

Added a 'netcat mode' to ssh(1): "ssh -W host:port ..." This connects stdio on the client to a single port forward on the server. This allows, for example, using ssh as a ProxyCommand to route connections via intermediate servers.

`ProxyCommand ssh proxyserver nc -q0 %h %p 2> /dev/null`

- Before the `-W` option was available, we used the `nc` (or netcat) utility. `nc` allows you to forward TCP & UDP packets to specified (alternate) locations and essentially behaves the same as `ssh -W` (as `ssh -W` was modeled after `nc`). In order for this variation to work the intermediate host(s) require(s) that `nc` be installed and the option `AllowTcpForwarding` must be enabled in the host's sshd_config (default: yes). The option `-q0` to `nc` is (supposed to be) for quieting errors, but I can't find which version this was introduced. (Note: `2> /dev/null` is probably to quite `ssh` errors, but one can use `ssh -q` instead.)

`ProxyCommand ssh proxyserver exec nc -q0 %h %p 2> /dev/null`

This is very much the same as the second variation, except you're calling the shell's built-in function `exec`. I'm not sure, but I believe there is no difference between including or excluding `exec` from the `ProxyCommand`; this variation should function everywhere the variation above does. For example, the Bash manual says something like this:

exec [-cl] [-a name] [command [arguments]]

If command is specified, it replaces the shell. No new process is created. The arguments become the arguments to command. If the -l option is supplied, the shell places a dash at the beginning of the zeroth argument passed to command. This is what login(1) does. The -c option causes command to be executed with an empty environment. If -a is supplied, the shell passes name as the zeroth argument to the executed command. If command cannot be executed for some reason, a non-interactive shell exits, unless the shell option execfail is enabled, in which case it returns failure. An interactive shell returns failure if the file cannot be executed. If command is not specified, any redirections take effect in the current shell, and the return status is 0. If there is a redirection error, the return status is 1.

Problem

Original source