Let SSH Use a Local SOCKS Listener When It Is Available

Scope an OpenSSH Match exec check to one destination and understand what a successful local-port probe does and does not establish.

A local SOCKS listener is useful on some networks and absent on others. OpenSSH can select a proxy command conditionally, without making that choice apply to every host.

For OpenSSH with the OpenBSD form of nc, an illustrative client configuration is:

Host work-server
    HostName ssh.example.net
    User alex

Match originalhost work-server exec "nc -z -w 1 127.0.0.1 1080"
    ProxyCommand nc -X 5 -x 127.0.0.1:1080 %h %p

Match all

originalhost restricts the check to the name supplied on the SSH command line. exec matches when its command exits successfully. The final Match all ends that conditional scope for following settings.

This assumes no earlier applicable setting has already selected a conflicting proxy command or jump route. SSH normally uses the first obtained value for a configuration option, so a broad default near the top can prevent a later condition from having the effect you expect.

A listening socket is a modest promise

The probe checks TCP access to a local port. It does not complete SOCKS negotiation, establish the desired destination connection, or prove which program owns that port. The listener can also disappear after the check.

The timeout keeps a failed probe bounded. The options shown belong to the OpenBSD nc interface; other programs with that filename can expose different options.

When the condition does not match, this example leaves the connection without this ProxyCommand, allowing its ordinary route. That is appropriate only when direct access is permitted. A mandatory proxy policy should not use an availability check as permission to escape onto a different route.

The target SSH hostname and host-key checks still identify the destination server. Selecting a transport helper is not a reason to accept an unexpected host key.

Related articles