Using a non-ssh ProxyCommand?

I have an ssh config with a ProxyCommand that isn’t a simple ssh proxy jump:

Host ssm-*
  ProxyCommand sh -c "aws ssm start-session --target $(echo %h | sed s/^ssm-//) --document-name AWS-StartSSHSession"

So when I run

ssh ssh ssm-i-89302843982043

the ssh client runs a shell command that strips out the ssm- prefix and runs

sh -c "aws ssm start-session --target i-89302843982043 --document-name AWS-StartSSHSession" --parameters portNumber=%p

This initiates an SSH session through the AWS SSM Session Manager instead of through a direct port connection, and then hands the stdin and stdout back to the regular ssh client to proceed with auth, opening channels, etc.

Would it work to:

1. Use child_process.spawn() (or something similar) to run the external command
2. Create a stream.Duplex using the child process’ stdin/out
3. Use that stream as the sock for an ssh2.Client connection

I plan to give this a try sometime in the next few days, but I figured I’d ask in case there’s a better idea (or just to get confirmation that this is the right path to go down).

[wujohns]

Finally, I find a npm module named “duplex-child-process”, and run the example success:

const fs = require('fs')
const { Client } = require('ssh2')
const Child_Process = require('duplex-child-process')

const privateKey = fs.readFileSync(`${ keyPath }`)
const proxyStream = Child_Process.spawn('ncat', ['--proxy', '127.0.0.1:7890', `${ targetIp }`, '22'])

const conn = new Client()
conn.connect({
  sock: proxyStream,
  username: 'root',
  privateKey
})

conn.on('ready', () => {
  console.log('Client :: ready')
  conn.exec('uptime', (err, stream) => {
    if (err) throw err
    stream.on('close', (code, signal) => {
      console.log('Stream :: close :: code: ' + code + ', signal: ' + signal)
      conn.end()
    }).on('data', (data) => {
      console.log('STDOUT: ' + data)
    }).stderr.on('data', (data) => {
      console.log('STDERR: ' + data)
    })
  })
})

[wujohns]

I will try to read the forwardOut function code, maybe there has exists the answer