Package: aws-ssh-proxy
AWS SSH ProxyAn sshProxyCommandutility that allows users to ssh by using the AWS EC2
instance names instead of having to remember the random public DNS names used by
AWS for each instance.The idea is that AWS EC2 instance names used will have a more memorable name
that users will be remember and share. With this utility it is now possible to
use these names as functional host names recognized by ssh and any other command
that relies on ssh:sshscprsyncsftpgitFUSEGnome's VFSInstallationTo install it run:pip install aws-ssh-proxyThen update your ssh configuration~/.ssh/configwith:Host *
    ProxyCommand aws-ssh-proxy %h %pYou might want to update your ssh configuration with a more specific rule.
See the rest of the document for a more elaborate setup.How it worksIn order to use this command with ssh it is required that the argumentProxyCommandis used. This will instruct ssh to request at the program passed
to establish the connection to the remote host.This program will then search the list of AWS EC2 instances that are running for
one who's name matches the hostname passed in parameter.For the program to work you will need to have your environment setup in order to
work with AWS. This usually means that you have the following environment
variables defined:AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYSSH ConfigurationModify your ssh configuration (~/.ssh/config) so thatProxyCommandusesaws-ssh-proxy.There are multiple ways to achieve this. In theory the following configuration
should work:Host *
    ProxyCommand aws-ssh-proxy %h %pAlthough the previous configuration will work it will probably create problems.
It is suggested that you read the next section and setup your own configuration.Advanced usageIt is best is you restrict the usage toaws-ssh-proxyto only the hosts that are
in AWS. You can achieve this by simply tricking ssh into believing that all
your hosts are under the same domain.The idea is to pretend that you own a given domain, for instance.awsand to
build an ssh rule that matches that domain. You do not need to own the domain
nor to have your server names with that domain.All that you need is to build a rule so that ssh can match connections to there
and to instruct it what to do:Host *.aws                                         # Pretend that our servers all end with .aws
    ProxyCommand aws-ssh-proxy --suffix .aws %h %p # Tell ssh to use aws-ssh-proxy to establish the connectionWit this we can now have the following host names in AWS:mysql-devwebserver-devAnd we can ssh to them withssh webserver-dev.awsandssh mysql-dev.aws. The.awssuffix is used only for telling which ssh configuration section to
trigger.The suffix can be anything, in fact it can be even a prefix and it would work
perfectly well too:Host aws-*
    ProxyCommand aws-ssh-proxy --prefix aws- %h %pTweaksYou can customize your ssh connections to your liking. It is possible to combine
this with other ssh rules.Prefiling the remote usernameIf your AWS EC2 instances are all of the same OS or if most are of the same OS
you can set the default user name, for instance Ubuntu servers use the usernameubuntuwhile AWS EC2's Amazon Linux 2 useec2-user.You can combine the rules with theUserdirective:Host *.aws                                          # Pretend that our servers all end with .aws
    User          ec2-user                          # Default username to use
    ProxyCommand  aws-ssh-proxy --suffix .aws %h %p # Tell ssh to use aws-ssh-proxy to establish the connectionYour ssh connection will then default to be done with the remote useec2-userand if you have a server with a different user you can still change it by
providing the user name in the command line:ssh -l ubuntu ubuntu-box.aws
ssh ubuntu@ubuntu-box.awsAvoiding: Remote host identification changedNOTE: Be aware that ignoring the server fingerprint can be a security risk!AWS EC2 hosts are ephemeral and can be recreated at any time. Sinceaws-ssh-proxyavoids that users need to remember that DNS public names and that they can rely
on common names it is possible that names will give ssh errors as EC2 instances
are replaced and the name remains unchanged.A typical ssh error when connecting to a host that has changed:@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff.
Please contact your system administrator.
Add correct host key in ~/.ssh/known_hosts to get rid of this message.
Offending key in ~/.ssh/known_hosts:1
RSA host key for 10.11.12.13 has changed and you have requested strict checking.
Host key verification failed.In order to avoid these errors it is possible to disableStrictHostKeyChecking.
Note that this will come at its own security risk. If you're not limiting this
your own AWS EC2 servers you can be under a lot of risk!The configuration can be done for all hosts.Host *.aws
    ProxyCommand            aws-ssh-proxy --suffix .aws %h %p
    StrictHostKeyChecking   no
    UserKnownHostsFile      /dev/nullNOTE: Be aware that ignoring the server fingerprint can be a security risk!Corporate firewall issues; http(s) proxy to the rescueIf you're behind a corporate firewall that prevents you from using ssh directly to AWS EC2 hosts you can try to use your corporate http(s) to the rescue.Host *.aws
    User          ec2-user
    ProxyCommand  aws-ssh-proxy --suffix .aws --auto-proxy %h %pWith--auto-proxythe environment variables for the proxy will be used in order to establish a connection via the proxy.This is the equivalent of running:nc -X connect -x $proxy_host:$proxy_port %h %pNOTE: You need netcat BSD to be installed for this to work.