UBC Wiki - User contributions [en]

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-09-15T06:35:05Z

GarsonSam: Added information about generating keys within the KRP.

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') provides an SSH tunnel between UBC '''SSH Proxy Pools''' and Internal '''SSH Destination Hosts'''. Once the connection via the SSH Proxy Pool to the SSH Destination Host is established, then other protocols may be emitted from the SSH Destination Host at the discretion of the SSH Destination Host system administrator. This service is intended for '''end-user use''' of SSH services.

It does not:

* allow other protocols to be emitted from the '''SSH Proxy Pools'''
* provide a full replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service].
* provide any user control or management of accounts or authentication on SSH Destination Hosts
* provide an approved method for administration of systems over SSH using privileged accounts. Remote SSH systems administration with privileged accounts should be facilitated through the use of the high-security [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC PAM (Privileged Access Management)] service. PAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.
[[File:Sshproxyservicescope.png|frameless|931x931px]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Address
!Port
!Credentials
|-
|SSH Proxy Pool - UBC Vancouver
|p01.sshp.cybersecurity.ubc.ca
142.103.90.160/28
|22
|CWL Production Account
|-
|SSH Key Registration Web Portal
|https://sshp.cybersecurity.ubc.ca/
|443
|CWL Production Account
|}
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || If you are a server administrator who would like to provide access to a server through the SSH Proxy Service, please see the '''Information for System Administrators and Destination Host Administrators''' section at the bottom of this page.
|}
{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
'''Interactive'''

* CWL accounts with MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* CWL usernames with SSH keys.
* MFA not required on authentication.
* CWL with MFA is required to register SSH keys at https://sshp.cybersecurity.ubc.ca/
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || At this time, there is no key expiration on SSH keys, but this may change in the future.
|}

== SSH Key Handling ==
Best practices:

* Do not reuse an existing SSH key pair for the SSH Proxy Service unless there is a specific operational requirement to do so.
* SSH keys consist of two parts: a '''private key''' and a '''public key'''.
* The '''public key''' is intended to be shared with systems that need to authenticate you.
* The '''private key''' must remain confidential and be protected at all times.
* Never copy your private key to another system unless it is one of your own trusted workstations or secure physical storage devices [such as encrypted disks or hardware security tokens]. If you must copy a private key, protect it with a strong passphrase.
* When SSH keys are used for automated, non-interactive authentication between systems, passphrase-less private keys may be appropriate.
* Automation keys should be unique to their intended purpose. Each distinct use case [for example, a different service, application, or automation script] should have its own dedicated SSH key pair. Do not reuse automation keys across multiple services or workflows.

=== SSH Key Generation ===
Keys should be generated following the Mozilla [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Keys may be generated within the SSH Proxy Registration Portal (Add New SSH Key -> Generate Key)

* The "Generate" button will generate a new key using your browser (you must then save the private key; the Key Registration Portal does not get a copy of your private key).
* After generating the key, the "Save" button will save it in your profile.

Keys may also be generated outside of the SSH Proxy Registration Portal and then uploaded to the SSH Proxy Registration Portal

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsshp_$(date +%Y%m%d) -C "UBC key for SSHP"

This creates one keypair consisting of a public and a private key. Register the '''public''' key in the SSH Proxy Key Registration Portal - '''NOT the private key'''.

== Use Case Patterns ==
See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SSHP ===
Connecting through SSHP Proxy Pool p01.sshp.cybersecurity.ubc.ca interactively with SSH to the Destination Host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.cybersecurity.ubc.ca <username>@<destination_host>
==== Example ====
Connect to '''foo.ubc.ca''' as user '''jbdoe-dest''' using CWL username '''jbdoe-cwl''' via SSHP:

$ ssh -J jbdoe-cwl@p01.sshp.cybersecurity.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (SSH Key-based) Auth to SSHP ===
Connecting through SSHP using SSH key-based auth requires you first create an SSHP Proxy Pool-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.cybersecurity.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsshp_20221206
User jbdoe-cwl

The ''IdentityFile'' is the private key corresponding to the private which you registered with the [https://sshp.cybersecurity.ubc.ca/ SSH Proxy Key Registration Portal].

The ''User'' is your CWL username. If you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.cybersecurity.ubc.ca).

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Key Registration Portal, the private key will be used during the authentication with the SSH Proxy Pool, and you will not be required to perform an interactive login with the SSH Proxy Pool -- however, you will still need to authenticate with the SSH Destination Host.

$ ssh -J p01.sshp.cybersecurity.ubc.ca jdoe-dest@ssh-target.misc.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

Repeated failed authentication attempts within a short period of time
may result in a temporary network block affecting access to this
proxy service from your source IP address.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
---------------------------------------------------------------------

Enter passphrase for key 'id_ed25519_ubcsshp_20221206':
SSH Proxy Session ID: ITSO-A4E59.2176796

SSH Proxy Pool login successful.

=====================================================================
DESTINATION HOST SESSION BEGINS BELOW THIS LINE
For further assistance, contact the destination host administrator.
=====================================================================

(jdoe-dest@ssh-target.misc.ubc.ca) Password:
Updates Information Summary: available
6 Security notice(s)
3 Important Security notice(s)
2 Medium Security notice(s)
1 Low Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last failed login: Fri May 15 23:26:30 UTC 2026 from 10.93.46.42 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Fri May 15 22:29:02 2026 from 10.93.46.42
[jdoe-dest@ssh-target ~]$

=== SSH Port Forwarding through SSHP ===
SSH port forwarding [also known as SSH tunneling] may be used through the SSH Proxy Service provided that the tunnel terminates on an authorized SSH Destination Host.

The SSH Proxy Service does not permit SSH Proxy Hosts to be used as port forwarding endpoints. However, once a connection to an SSH Destination Host has been established through the SSH Proxy Service, standard SSH port forwarding features, if supported by the SSH Destination Host, remain available.

For an introduction to SSH tunneling concepts and usage patterns, see:

* [https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding Ubuntu Community Documentation: SSH/OpenSSH/PortForwarding]
* [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Tunnels Wikibooks OpenSSH/Cookbook/Tunnels]

==== Example ====
Create a local tunnel to www.ubc.ca:443 through an SSH Destination Host:
ssh -N -J <cwlusername>@p01.sshp.cybersecurity.ubc.ca -L 8443:www.ubc.ca:443 \
<destination_username>@<destination_host>
The resulting traffic path is:

User Workstation:8443 ==> SSH Proxy Host ==> SSH Destination Host ==> www.ubc.ca:443

The SSH tunnel is established on the SSH Destination Host. Any outbound connections generated by the tunnel originate from the SSH Destination Host and are subject to the policies, network controls, and authorization decisions of the SSH Destination Host administrator.

==== Limitation ====
SSH Proxy Hosts cannot be used as general-purpose TCP forwarding endpoints.

For example, the following connection attempt is not permitted and will fail because it does not use the destination as the tunnel endpoint - it uses the proxy host itself:
ssh -N -L 8443:www.ubc.ca:443 <cwlusername>@p01.sshp.cybersecurity.ubc.ca
When traffic attempts to use the tunnel, the SSH client will receive an error similar to:
channel 2: open failed: administratively prohibited: open failed
This behavior is intentional and prevents SSH Proxy Hosts from being used as generic network relays.

=== Using SSHP via ssh config ===
Connecting with SSH to a Destination Host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.cybersecurity.ubc.ca

However, doing this will result in the p01.sshp.cybersecurity.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SSHP Proxy Pool that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SSHP Proxy Pool p01.sshp.cybersecurity.ubc.ca with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections to the Destination Host through SSHP from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SSHP with an SSHP-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SSHP.

''~/.ssh/config''

Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsshp_20221206

Host foo.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your CWL password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SSHP for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SSHP):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SSHP for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.cybersecurity.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SSHP Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.cybersecurity.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SSHP: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.cybersecurity.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SSHP: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SSHP: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SSHP: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsshp_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.cybersecurity.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SSHP: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsshp_20221206

Match Host *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.cybersecurity.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SSHP: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

=== Silent mode: Suppressing proxy-side output for non-interactive workflows ===
The SSH Proxy banner and SSH Proxy Session ID are displayed on STDERR - you can see them, but they do not appear on STDOUT, so the majority of non-interactive workflows will not capture them or be affected by them [eg: > or >> redirects].

However, should you encounter difficulty with the banner or the SSH Proxy Session ID being displayed, you can suppress them following the instructions below.

==== Banner Suppression ====
To suppress the banner that is displayed when you connect to the service, you can disable the '''Display SSH Banner''' option in the Key Registration Portal.

==== SSH Proxy Session ID Suppression ====
To suppress the SSH Proxy Session ID that is displayed when you connect to the service, you can disable the '''Display SSH Proxy Session ID''' option in the Key Registration Portal. If you need support, you may be asked to re-enable this feature to allow us to assist you with troubleshooting.

==== Full Suppression Workaround [Unsupported] ====
Some non-interactive workflows require clean STDOUT/STDERR from the SSH Destination Host, such as database dumps, scripts, rsync-like tools, or SSH used as a transport. You can use this workaround but please note that it is not supported - we cannot provide assistance to users with this workaround.

Avoid suppressing STDERR on the outer SSH command, for example:

ssh destination-host 'mysqldump ...' 2>/dev/null

This suppresses all STDERR from the SSH command, including useful errors from the destination host or remote command.

Instead, use ProxyCommand to suppress STDERR '''only''' from the SSH Proxy Pool connection:

Host p01.sshp.cybersecurity.ubc.ca
User <cwlusername>
IdentityFile ~/.ssh/id_ed25519_ubcsshp_20221206

Host destination-host
User <destination_username>
ProxyCommand ssh p01.sshp.cybersecurity.ubc.ca -W %h:%p 2>/dev/null

With this pattern, proxy-side banner/session output is suppressed, while STDERR from the SSH Destination Host and remote command is still displayed.

== Common Issues and Troubleshooting ==
{| class="wikitable"
!'''Error Message'''
!'''Was SSH Proxy Session ID† Displayed'''
!'''Was Destination Host Notice‡ Displayed'''
!'''Probable Causes'''
!'''Correction'''
|- valign="top"
|
Error 500: SSH Proxy Service error. Submit a ticket at <nowiki>https://it.ubc.ca/selfservice</nowiki>.

Connection closed by <ip address> port 22

Connection closed by UNKNOWN port 65535
|No
|No
|SSH Proxy Service server-side error.
|This is a service error that has to be corrected by the SSH Proxy Service administrators. Submit a ticket to notify us of the error.
|- valign="top"
|
Error 503: SSH Proxy Service is currently offline. Please try again later.

Connection closed by <ip address> port 22

Connection closed by UNKNOWN port 65535
|No
|No
|SSH Proxy Service has been intentionally taken offline.
|Try again later, watch status.it.ubc.ca for updates.
|- valign="top"
|
<after three password attempts>

jdoe@p01.sshp.devl.infosec.it.ubc.ca: Permission denied (publickey,keyboard-interactive).

Connection closed by UNKNOWN port 65535
|No
|No
|Invalid CWL username or password.
|Check to ensure that your username and password are valid.
|- valign="top"
|
(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Password:

(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jdoe

Enter a passcode:
|No
|No
|Account is enrolled in Duo MFA, but does not have a license for Duo.
|Submit a ticket to request a Duo MFA license.
|- valign="top"
|
<SSH key provided as authentication parameter>

(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Password:
|No
|No
|'''Cause 1'''

Public SSH key is not registered in portal.

'''Cause 2'''

Public SSH key is registered in portal, but hasn't been pushed to the proxy pool yet.

'''Cause 3'''

Private SSH key cannot be read.
|'''Correction 1'''

Register public SSH key in portal.

'''Correction 2'''

Wait 2-5 minutes, try again.

'''Correction 3'''

Ensure that permissions on your private SSH key are correct. See this video for more information.
|- valign="top"
|
no such identity: <filename>: No such file or directory

(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Password:
|No
|No
|Private SSH key does not exist.
|Check name for typo, check to ensure file exists as displayed.
|- valign="top"
|
no such identity: <filename>: Permission denied

(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Password:
|No
|No
|Permissions on directory holding private key is too restrictive.
|Set permissions on key directory to be readable by current user.
|- valign="top"
|
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@ WARNING: UNPROTECTED PRIVATE KEY FILE! @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Permissions <permissions> for '<filename>' are too open.

It is required that your private key files are NOT accessible by others.

This private key will be ignored.

Load key "<filename>": bad permissions

(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Password:
|No
|No
|Private key file has permissions that are too open.
|Set permissions on file to 0400 (user: read, group: none, other:none). See this video for more information.
|- valign="top"
|
Load key "<filename>": Permission denied

(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Password:
|No
|No
|Private key file has permissions that are too restrictive.
|Set permissions on file to 0400 (user: read, group: none, other:none). See this video for more information.
|- valign="top"
|
SSH Proxy Session ID: <session id>

Error 403: Authorization denied by SSH Proxy Service policy.

Connection closed by <ip address> port 22

Connection closed by UNKNOWN port 65535
|Yes
|No
|'''Cause 1'''

User account is disabled.

'''Cause 2'''

User does not have the required permissions to use the SSH Proxy Service.
|'''Correction 1'''

Check to ensure your CWL account is working by logging in at <nowiki>https://myaccount.ubc.ca</nowiki>.

'''Correction 2'''

Submit a ticket for the SSH Proxy Service.
|- valign="top"
|
channel 0: open failed: administratively prohibited: open failed

stdio forwarding failed

Connection closed by UNKNOWN port 65535
|Yes
|Yes
|'''Cause 1'''

Typo in the Destination Host name or port (a default port of 22 is assumed but some Destination Hosts may be using a non-standard port).

'''Cause 2'''

Attempting to reach a Destination Host that is not authorized.
|'''Correction 1'''

Check to ensure that the Destination Host name (and port, if provided) are correct.

'''Correction 2'''

Request that the Destination Host be registered with the SSH Proxy Service.
|- valign="top"
|
channel 0: open failed: connect failed: open failed

Connection to p01.sshp.cybersecurity.ubc.ca closed.
|Yes
|Yes
|Attempting to login to the proxy host directly via SSH.
|Use the proxy pool via the -J parameter or ProxyJump option.
|- valign="top"
|
<very long delay before message>

channel 0: open failed: connect failed: Connection timed out

stdio forwarding failed

Connection closed by UNKNOWN port 65535
|Yes
|Yes
|Destination host is authorized but is not responding.
|Contact the Destination Host administrator for assistance. The host may be offline, or a firewall on the destination side is blocking the connection attempt.
|- valign="top"
|
<displayed by itself AFTER the Destination Host Notice>

Connection closed by UNKNOWN port 65535
|Yes
|Yes
|Destination Host is authorized and destination port is open, but it is not communicating using SSH.
|Contact the Destination Host administrator for assistance.
|}
{| class="wikitable"
|† The '''SSH Proxy Session ID''' will only be shown when authentication to the proxy pool is successful. If you see the SSH Proxy Session ID, the username, password, MFA challenges have passed, or a valid SSH key was provided.
'''NOTE:''' If you turned off the Display SSH Proxy Session ID option in the SSH Proxy Key Registration Portal, the SSH Proxy Session ID will never be displayed.

An example of a successful authentication displaying an SSH Proxy Session ID is:
SSH Proxy Session ID: ITSO-A4E59.0353334

SSH Proxy Pool login successful.
‡ The '''Destination Host Notice''' refers to the following text which appears after the SSH Proxy Service has authenticated and authorized the user, and determined that the destination is authorized.

'''NOTE:''' If you turned off the Display Banner option in the SSH Proxy Key Registration Portal, the Destination Host Notice will never be displayed.
=====================================================================

DESTINATION HOST SESSION BEGINS BELOW THIS LINE

For further assistance, contact the destination host administrator.

=====================================================================
|}

== Information for System Administrators and Destination Host Administrators ==

=== Modifying Firewall Rules ===
To allow inbound communication from a specific SSH Proxy Pool, open your inbound firewalls to the address listed in the '''Connectivity Information''' section of this page for your specific Destination Host and Port.

=== Adding Destination Hosts ===
To request a host be added as a Destination Host, please submit a [https://ubc.service-now.com/selfservice?id=sc_cat_item_v2&sys_id=9440ab761b136c500dbaec21b24bcbbb Cybersecurity Services Support Request] through the UBC Self-Service Portal. Provide the following information:

# Your department and role
# Destination Hostname (FQDN)
## Only Destination Hosts with FQDNs are eligible for this service
# Destination IP Address
# Destination Port
# Technical Owner Name
# Technical Owner Email
# Business Owner Name
# Business Owner Email
# Reason

A request has been submitted to have a custom form for this type of request.

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding the SSH Proxy Service, please submit a [https://ubc.service-now.com/selfservice?id=sc_cat_item_v2&sys_id=9440ab761b136c500dbaec21b24bcbbb Cybersecurity Services Support Request] through the UBC Self-Service Portal.

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-05-15T23:58:41Z

GarsonSam: /* Using SPS via ssh config */

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test cases below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid CWL production (for logging into the SSH Proxy Pool) and CWL staging account (for logging into the SSH Key Registration Portal and the test SSH Destination Host).

- Have an SSH Destination Host to connect to (a test host has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca).
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') provides an SSH tunnel between the '''SSH Proxy Pools''' and the '''SSH Destination Hosts'''. Once the SSH tunnel to the SSH Destination Host is established, then other protocols may be emitted from the SSH Destination Host at the discretion of the SSH Destination Host system administrator. This service is intended for '''end-user use''' of SSH services.

It does not:

* allow other protocols to be emitted from the '''SSH Proxy Pools'''
* provide a full replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service].
* provide any user control or management of accounts or authentication on SSH Destination Hosts
** provide an approved method for administration of systems over SSH using privileged accounts. Remote SSH systxems administration with privileged accounts should be facilitated through the use of the high-security [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC PAM (Privileged Access Management)] service. PAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.
[[File:Sshproxyservicescope.png|frameless|931x931px]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
!Credentials
|-
|SSH Proxy Pool
|p01.sshp.cybersecurity.ubc.ca
|22
|CWL Production Account
|-
|SSH Key Registration Web Portal
|https://sshp.cybersecurity.ubc.ca/
|443
|CWL Production Account
|-
|SSH Proxy TEST Destination Host
|ssh-target.misc.devl.infosec.it.ubc.ca
|22
|CWL Production Account
(Cybersecurity user group only)
|}

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://sshp.cybersecurity.ubc.ca/
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Service unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

'''Which credentials are supported in the test deployment?'''

CWL Production Account: Access to SSH Proxy Pools, Key Registration Portal

CWL Production Account (for Cybersecurity users) to access the test destination host

(Non-Cybersecurity users are asked to submit an SSHP onboarding request to have their desired destination host onboarded if it is not already accessible via SSHP).

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe@p01.sshp.cybersecurity.ubc.ca jbdoe@ssh-target.misc.devl.infosec.it.ubc.ca

#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

Repeated failed authentication attempts within a short period of time
may result in a temporary network block affecting access to this
proxy service from your source IP address.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
---------------------------------------------------------------------

(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jdoe@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jdoe

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3):

Pushed a login request to your device...
Success. Logging you in...
SSH Proxy Session ID: ITSO-A4E59.2114461

SSH Proxy Pool login successful.

=====================================================================
DESTINATION HOST SESSION BEGINS BELOW THIS LINE
For further assistance, contact the destination host administrator.
=====================================================================

(jdoe@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
6 Security notice(s)
3 Important Security notice(s)
2 Medium Security notice(s)
1 Low Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Thu Apr 30 04:11:02 2026 from 10.93.46.42
[jdoe@ssh-target ~]$ ~

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to PAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - not all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.cybersecurity.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.cybersecurity.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.cybersecurity.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentityFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Pool (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Pool, your private key will be used during the authentication with the SSH Proxy Pool, and you will not be required to perform an interactive login with the SSH Proxy Pool -- however, you will still need to authenticate with the SSH Destination Host.

$ ssh -J p01.sshp.cybersecurity.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

Repeated failed authentication attempts within a short period of time
may result in a temporary network block affecting access to this
proxy service from your source IP address.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
---------------------------------------------------------------------

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH Proxy Session ID: ITSO-A4E59.2176796

SSH Proxy Pool login successful.

=====================================================================
DESTINATION HOST SESSION BEGINS BELOW THIS LINE
For further assistance, contact the destination host administrator.
=====================================================================

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
6 Security notice(s)
3 Important Security notice(s)
2 Medium Security notice(s)
1 Low Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last failed login: Fri May 15 23:26:30 UTC 2026 from 10.93.46.42 on ssh:notty
There was 1 failed login attempt since the last successful login.
Last login: Fri May 15 22:29:02 2026 from 10.93.46.42
[jdoe-dest@ssh-target ~]$

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.cybersecurity.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.cybersecurity.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.cybersecurity.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.cybersecurity.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.cybersecurity.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.cybersecurity.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.cybersecurity.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.cybersecurity.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy Pool DNS name
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-05-15T22:38:18Z

GarsonSam:

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test cases below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid CWL production (for logging into the SSH Proxy Pool) and CWL staging account (for logging into the SSH Key Registration Portal and the test SSH Destination Host).

- Have an SSH Destination Host to connect to (a test host has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca).
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') provides an SSH tunnel between the '''SSH Proxy Pools''' and the '''SSH Destination Hosts'''. Once the SSH tunnel to the SSH Destination Host is established, then other protocols may be emitted from the SSH Destination Host at the discretion of the SSH Destination Host system administrator. This service is intended for '''end-user use''' of SSH services.

It does not:

* allow other protocols to be emitted from the '''SSH Proxy Pools'''
* provide a full replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service].
* provide any user control or management of accounts or authentication on SSH Destination Hosts
** provide an approved method for administration of systems over SSH using privileged accounts. Remote SSH systxems administration with privileged accounts should be facilitated through the use of the high-security [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC PAM (Privileged Access Management)] service. PAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.
[[File:Sshproxyservicescope.png|frameless|931x931px]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
!Credentials
|-
|SSH Proxy Pool
|p01.sshp.cybersecurity.ubc.ca
|22
|CWL Production Account
|-
|SSH Key Registration Web Portal
|https://sshp.cybersecurity.ubc.ca/
|443
|CWL Production Account
|-
|SSH Proxy TEST Destination Host
|ssh-target.misc.devl.infosec.it.ubc.ca
|22
|CWL Production Account
(Cybersecurity user group only)
|}

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://sshp.cybersecurity.ubc.ca/
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Service unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

'''Which credentials are supported in the test deployment?'''

CWL Production Account: Access to SSH Proxy Pools, Key Registration Portal

CWL Production Account (for Cybersecurity users) to access the test destination host

(Non-Cybersecurity users are asked to submit an SSHP onboarding request to have their desired destination host onboarded if it is not already accessible via SSHP).

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe@p01.sshp.cybersecurity.ubc.ca jbdoe@ssh-target.misc.devl.infosec.it.ubc.ca

#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to PAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - not all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentityFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Pool (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Pool, your private key will be used during the authentication with the SSH Proxy Pool, and you will not be required to perform an interactive login with the SSH Proxy Pool -- however, you will still need to authenticate with the SSH Destination Host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy Pool DNS name
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-05-15T20:46:12Z

GarsonSam:

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test cases below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid CWL production (for logging into the SSH Proxy Pool) and CWL staging account (for logging into the SSH Key Registration Portal and the test SSH Destination Host).

- Have an SSH Destination Host to connect to (a test host has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca).
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') provides an SSH tunnel between the '''SSH Proxy Pools''' and the '''SSH Destination Hosts'''. Once the SSH tunnel to the SSH Destination Host is established, then other protocols may be emitted from the SSH Destination Host at the discretion of the SSH Destination Host system administrator. This service is intended for '''end-user use''' of SSH services.

It does not:

* allow other protocols to be emitted from the '''SSH Proxy Pools'''
* provide a full replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service].
* provide any user control or management of accounts or authentication on SSH Destination Hosts
** provide an approved method for administration of systems over SSH using privileged accounts. Remote SSH systxems administration with privileged accounts should be facilitated through the use of the high-security [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC PAM (Privileged Access Management)] service. PAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.
[[File:Sshproxyservicescope.png|frameless|931x931px]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
!Credentials
|-
|SSH Proxy Pool
|p01.sshp.cybersecurity.ubc.ca
|22
|CWL Production Account
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|CWL Production Account
|-
|SSH Proxy TEST Destination Host
|ssh-target.misc.devl.infosec.it.ubc.ca
|22
|CWL Production Account
|}

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Service unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

'''Which credentials are supported in the test deployment?'''

CWL Production Account: Access to SSH Proxy Pools, Key Registration Portal

CWL Production Account (for Cybersecurity users) to access the test destination host

(Non-Cybersecurity users are asked to submit an SSHP onboarding request to have their desired destination host onboarded if it is not already accessible via SSHP).

CWL Staging Account: Access to Key Registration Portal, and the test destination host

Note: If your staging account password cannot be reset via [https://www.myaccount.stg.id.ubc.ca/myAccount/ MyAccount-STG], then a ticket may be submitted to UBCIT - IAM to request a password reset.

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to PAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - not all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentityFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Pool (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Pool, your private key will be used during the authentication with the SSH Proxy Pool, and you will not be required to perform an interactive login with the SSH Proxy Pool -- however, you will still need to authenticate with the SSH Destination Host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy Pool DNS name
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-29T20:07:36Z

GarsonSam: password reset for stg instructions under FAQ

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test cases below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid CWL production (for logging into the SSH Proxy Pool) and CWL staging account (for logging into the SSH Key Registration Portal and the test SSH Destination Host).

- Have an SSH Destination Host to connect to (a test host has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca).
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') provides an SSH tunnel between the '''SSH Proxy Pools''' and the '''SSH Destination Hosts'''. Once the SSH tunnel to the SSH Destination Host is established, then other protocols may be emitted from the SSH Destination Host at the discretion of the SSH Destination Host system administrator. This service is intended for '''end-user use''' of SSH services.

It does not:

* allow other protocols to be emitted from the '''SSH Proxy Pools'''
* provide a full replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service].
* provide any user control or management of accounts or authentication on SSH Destination Hosts
** provide an approved method for administration of systems over SSH using privileged accounts. Remote SSH systxems administration with privileged accounts should be facilitated through the use of the high-security [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC PAM (Privileged Access Management)] service. PAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.
[[File:Sshproxyservicescope.png|frameless|931x931px]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
!Credentials
|-
|SSH Proxy Pool
|p01.sshp.devl.infosec.it.ubc.ca
|22
|CWL Production Account
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|CWL STG Account
|-
|SSH Proxy TEST Destination Host
|ssh-target.misc.devl.infosec.it.ubc.ca
|22
|CWL STG Account
|}

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Service unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

'''Which credentials are supported in the test deployment?'''

CWL Production Account: Access to SSH Proxy Pools

CWL Staging Account: Access to Key Registration Portal, and the test destination host

Note: If your staging account password cannot be reset via [https://www.myaccount.stg.id.ubc.ca/myAccount/ MyAccount-STG], then a ticket may be submitted to UBCIT - IAM to request a password reset.

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to PAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - not all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentityFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Pool (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Pool, your private key will be used during the authentication with the SSH Proxy Pool, and you will not be required to perform an interactive login with the SSH Proxy Pool -- however, you will still need to authenticate with the SSH Destination Host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy Pool DNS name
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-24T17:07:25Z

GarsonSam:

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test case below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid CWL production (for logging into the SSH proxy host) and CWL staging account (for logging into the SSH key registration portal and the test destination host).

- Have a proxy destination host to connect to (a sample has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Pools''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC PAM (Privileged Access Management)] service. PAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
!Credentials
|-
|SSH Proxy Pool
|p01.sshp.devl.infosec.it.ubc.ca
|22
|CWL Production Account
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|CWL STG Account
|-
|SSH Proxy TEST Destination Host
|ssh-target.misc.devl.infosec.it.ubc.ca
|22
|CWL STG Account
|}

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

'''Which credentials are supported in the test deployment?'''

CWL Production Account: Access to SSH Proxy Pools

CWL Staging Account: Access to Key Registration Portal, and the test destination host

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to PAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - not all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentityFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Host (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Host, your private key will be used during the authentication with the SSH Proxy Host, and you will not be required to perform an interactive login with the SSH Proxy Host -- however, you will still need to authenticate with the destination host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy hostname
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-23T20:45:04Z

GarsonSam:

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test case below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid CWL production (for logging into the SSH proxy host) and CWL staging account (for logging into the SSH key registration portal and the test destination host).

- Have a proxy destination host to connect to (a sample has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC PAM (Privileged Access Management)] service. PAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|p01.sshp.devl.infosec.it.ubc.ca
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

'''Which credentials are supported in the test deployment?'''

CWL Production Account: Access to SSH Proxy Hosts

CWL Staging Account: Access to Key Registration Portal, and the test destination host

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to PAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - not all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentityFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Host (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Host, your private key will be used during the authentication with the SSH Proxy Host, and you will not be required to perform an interactive login with the SSH Proxy Host -- however, you will still need to authenticate with the destination host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy hostname
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-23T20:30:47Z

GarsonSam:

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test case below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid CWL prod and CWL staging account.

- Have a proxy destination host to connect to (a sample has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC PAM (Privileged Access Management)] service. PAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|p01.sshp.devl.infosec.it.ubc.ca
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to PAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - not all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentityFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Host (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Host, your private key will be used during the authentication with the SSH Proxy Host, and you will not be required to perform an interactive login with the SSH Proxy Host -- however, you will still need to authenticate with the destination host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy hostname
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-23T20:25:02Z

GarsonSam:

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test case below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid CWL prod and CWL staging account.

- Have a proxy destination host to connect to (a sample has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://privacymatters.ubc.ca/esam UBC eSAM (Enhanced System Access Management)] service. eSAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|p01.sshp.devl.infosec.it.ubc.ca
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

SSH connections can be made to ssh.infosec.it.ubc.ca port 22. For the PoC, there are no '''intentional''' session timeouts implemented. Should SPS enter production, a formal decision on intentional session timeouts will be made.

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to eSAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - note all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentifyFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Host (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Host, your private key will be used during the authentication with the SSH Proxy Host, and you will not be required to perform an interactive login with the SSH Proxy Host -- however, you will still need to authenticate with the destination host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy hostname
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-23T20:23:30Z

GarsonSam: /* How does this align with the UBC Enhanced System Access Management (eSAM) service? */

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test case below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid cwl staging account.

- Have a proxy destination host to connect to (a sample has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://privacymatters.ubc.ca/esam UBC eSAM (Enhanced System Access Management)] service. eSAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|p01.sshp.devl.infosec.it.ubc.ca
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

SSH connections can be made to ssh.infosec.it.ubc.ca port 22. For the PoC, there are no '''intentional''' session timeouts implemented. Should SPS enter production, a formal decision on intentional session timeouts will be made.

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://it.ubc.ca/services/accounts-passwords/privileged-access-management-pam UBC Privileged Access Management Service?] ====
This service is intended for user activities using unprivileged accounts. It is not a replacement or competitor for the UBC PAM service, which is the correct solution for system administration activities using privileged accounts. If you are an administrator, you are encouraged to enroll your server into PAM. The below table outlines the differences between using PAM vs SSHP for access to servers.
{| class="wikitable"
!
!PAM
!SSHP
|-
|System administration
|Y
|N
|-
|Automatic credential rollover
|Y
|N
|-
|Logging
|Logging and session monitoring/recording.
|Only logs connection attempts.
|-
|Redundancy
|Y
|Y
|-
|Delegated administration
|Y
|N
|-
|Requires server to be registered
|Y
|Y
|-
|Credential Storage
|Y
|N
|}
SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to eSAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - note all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentifyFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Host (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Host, your private key will be used during the authentication with the SSH Proxy Host, and you will not be required to perform an interactive login with the SSH Proxy Host -- however, you will still need to authenticate with the destination host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy hostname
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-22T20:38:57Z

GarsonSam:

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test case below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid cwl staging account.

- Have a proxy destination host to connect to (a sample has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://privacymatters.ubc.ca/esam UBC eSAM (Enhanced System Access Management)] service. eSAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|p01.sshp.devl.infosec.it.ubc.ca
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

SSH connections can be made to ssh.infosec.it.ubc.ca port 22. For the PoC, there are no '''intentional''' session timeouts implemented. Should SPS enter production, a formal decision on intentional session timeouts will be made.

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://privacymatters.ubc.ca/esam UBC Enhanced System Access Management (eSAM) service?] ====
<replace with callout block>

eSAM is used for system-administration tasks and requires VPN with a CWL admin account. eSAM offers session recording, privileged account management, and many other security features which make it the right choice for system administration work. If you're doing sysadmin-type things, eSAM is the way (not just for SSH, either - it can do RDP, web, and more). eSAM offers the highest level of security, stores credentials, and has a relatively high level of friction which end users would not find acceptable.

SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to eSAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - note all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentifyFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Host (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Host, your private key will be used during the authentication with the SSH Proxy Host, and you will not be required to perform an interactive login with the SSH Proxy Host -- however, you will still need to authenticate with the destination host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Common Issues and Troubleshooting ==
'''Permission Denied Error'''

Possible causes:

* Incorrect username
* Missing SSH key
* Access not granted to the target server

Solution:

* Verify credentials
* Confirm your SSH key is registered
* Contact IT support if access is missing

'''Connection Timed Out'''

Possible causes:

* Firewall blocking SSH
* Incorrect hostname
* Network connectivity issue

Solution:

* Verify the SSH Proxy hostname
* Check internet connectivity
* Ensure port 22 is not blocked

'''MFA Authentication Failure'''

Possible causes:

* Device not enrolled in MFA
* Authentication request denied

Solution:

* Ensure MFA device is properly configured
* Retry login and approve the request

'''Best Practices'''

To ensure secure usage:

* Use '''SSH keys instead of passwords'''
* Protect your private keys with a passphrase
* Keep your SSH client updated
* Disconnect sessions when finished
* Do not store credentials in scripts

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-21T22:24:11Z

GarsonSam: /* How does this align with the UBC Enhanced System Access Management (eSAM) service? */

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test case below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid cwl staging account.

- Have a proxy destination host to connect to (a sample has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://privacymatters.ubc.ca/esam UBC eSAM (Enhanced System Access Management)] service. eSAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|p01.sshp.devl.infosec.it.ubc.ca
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

SSH connections can be made to ssh.infosec.it.ubc.ca port 22. For the PoC, there are no '''intentional''' session timeouts implemented. Should SPS enter production, a formal decision on intentional session timeouts will be made.

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://privacymatters.ubc.ca/esam UBC Enhanced System Access Management (eSAM) service?] ====
<replace with callout block>

eSAM is used for system-administration tasks and requires VPN with a CWL admin account. eSAM offers session recording, privileged account management, and many other security features which make it the right choice for system administration work. If you're doing sysadmin-type things, eSAM is the way (not just for SSH, either - it can do RDP, web, and more). eSAM offers the highest level of security, stores credentials, and has a relatively high level of friction which end users would not find acceptable.

SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to eSAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - note all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentifyFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Host (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Host, your private key will be used during the authentication with the SSH Proxy Host, and you will not be required to perform an interactive login with the SSH Proxy Host -- however, you will still need to authenticate with the destination host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-21T17:39:23Z

GarsonSam: /* FAQ */

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|In order to successfully complete the test case below, you must:
- Be connected to the UBC VPN via the ubcit.tech VPN pool

- Have a valid cwl staging account.

- Have a proxy destination host to connect to (a sample has been provisioned at: ssh-target.misc.devl.infosec.it.ubc.ca
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://privacymatters.ubc.ca/esam UBC eSAM (Enhanced System Access Management)] service. eSAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|p01.sshp.devl.infosec.it.ubc.ca
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

SSH connections can be made to ssh.infosec.it.ubc.ca port 22. For the PoC, there are no '''intentional''' session timeouts implemented. Should SPS enter production, a formal decision on intentional session timeouts will be made.

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

Register the key in the key registration portal.

== FAQ ==

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Password:
(jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-1234
2. Phone call to XXX-XXX-1234
3. SMS passcodes to XXX-XXX-1234

Passcode or option (1-3): 1

Pushed a login request to your device...
Success. Logging you in...
(jbdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Mon Apr 20 19:44:56 2026 from 10.93.10.93
[jbdoe-dest@ssh-target ~]$

==== How does this align with the [https://privacymatters.ubc.ca/esam UBC Enhanced System Access Management (eSAM) service?] ====
eSAM is used for system-administration tasks and requires VPN with a CWL admin account. eSAM offers session recording, privileged account management, and many other security features which make it the right choice for system administration work. If you're doing sysadmin-type things, eSAM is the way (not just for SSH, either - it can do RDP, web, and more). eSAM offers the highest level of security, stores credentials, and has a relatively high level of friction which end users would not find acceptable.

SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to eSAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - note all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@p01.sshp.devl.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host p01.sshp.devl.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206
User jbdoe-cwl

The ''IdentifyFile'' is the private key corresponding to the private which you registered with the Key Registration Proxy.

The ''User'' is the user which you use to access the SSH Proxy Host (if you do not specify a username in the ''config'' file, you will need to specify it in the connection string (i.e. jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca)

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

Because the public key has been registered with the SSH Proxy Host, your private key will be used during the authentication with the SSH Proxy Host, and you will not be required to perform an interactive login with the SSH Proxy Host -- however, you will still need to authenticate with the destination host.

$ ssh -J p01.sshp.devl.infosec.it.ubc.ca jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca
#####################################################################
UBC SSH Proxy Service <nowiki>https://it.ubc.ca</nowiki>
------------------------------ NOTICE -------------------------------
You are connecting to the UBC SSH Proxy Service.

After authentication succeeds here, your SSH client will connect
through this proxy to your destination host.

Any subsequent username, password, MFA, or host key prompts may be
originating from your destination host, not from this proxy service.

If authentication or access fails after the proxy connection has
been established, contact the administrator of your destination host.

The use of this proxy service may be monitored and recorded for
administrative and security purposes. Monitoring is limited to
activity on the proxy service itself and does not include activity
on your destination host, which may be monitored separately. Anyone
accessing this service expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, UBC may provide that evidence to law enforcement officials.
#####################################################################

Enter passphrase for key 'id_ed25519_ubcsps_20221206':
SSH proxy login successful. Further authentication is handled by the destination host.
Contact the destination host administrator if access fails beyond this point.

(jdoe-dest@ssh-target.misc.devl.infosec.it.ubc.ca) Password:
Updates Information Summary: available
8 Security notice(s)
5 Important Security notice(s)
3 Medium Security notice(s)

, #_
~\_ ####_ Amazon Linux 2023
~~ \_#####\
~~ \###|
~~ \#/ ___ <nowiki>https://aws.amazon.com/linux/amazon-linux-2023</nowiki>
~~ V~' '->
<nowiki> ~~~ /</nowiki>
~~._. _/
_/ _/
_/m/'
Last login: Tue Apr 21 16:56:23 2026 from 10.93.10.93
[jdoe-dest@ssh-target ~]$ ls

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

However, doing this will result in the p01.sshp.devl.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J p01.sshp.devl.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@p01.sshp.devl.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host p01.sshp.devl.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump p01.sshp.devl.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-21T04:46:20Z

GarsonSam: /* Non-Interactive (Key-based) Auth to SPS */

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-20T20:16:49Z

GarsonSam: /* Interactive Auth to SPS */

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-20T20:10:28Z

GarsonSam: /* How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? */

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-13T20:23:05Z

GarsonSam:

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-13T19:18:11Z

GarsonSam:

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-04-13T18:52:01Z

GarsonSam: Updated testing requirements

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-03-30T20:14:27Z

GarsonSam: /* Connectivity Information */

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Garson to add some notes in here around the requirements that you have to be connected to the ubcit.tech pool, and have a cwl staging account, in order to test this service
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://privacymatters.ubc.ca/esam UBC eSAM (Enhanced System Access Management)] service. eSAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|https://ssh-proxy.misc.devl.infosec.it.ubc.ca/
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

SSH connections can be made to ssh.infosec.it.ubc.ca port 22. For the PoC, there are no '''intentional''' session timeouts implemented. Should SPS enter production, a formal decision on intentional session timeouts will be made.

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

== FAQ ==

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@ssh.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca
UBC JumpHost
(jbdoe-cwl@ssh.infosec.it.ubc.ca) Password:
(jbdoe-cwl@ssh.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-4099
2. Duo Push to iPad Pro (iOS)
3. Phone call to XXX-XXX-4099
4. SMS passcodes to XXX-XXX-4099

Passcode or option (1-4): cccdfabcrrbbnctkqidcrkiirkvgfvtgfdgvvfqnhntfib
Last login: Wed Jan 11 10:08:06 2023 from 206.87.62.99
[jbdoe-dest@foo ~]$

==== How does this align with the [https://privacymatters.ubc.ca/esam UBC Enhanced System Access Management (eSAM) service?] ====
eSAM is used for system-administration tasks and requires VPN with a CWL admin account. eSAM offers session recording, privileged account management, and many other security features which make it the right choice for system administration work. If you're doing sysadmin-type things, eSAM is the way (not just for SSH, either - it can do RDP, web, and more). eSAM offers the highest level of security, stores credentials, and has a relatively high level of friction which end users would not find acceptable.

SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to eSAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - note all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@ssh.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@ssh.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host ssh.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump ssh.infosec.it.ubc.ca

However, doing this will result in the ssh.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host ssh.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host ssh.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump ssh.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J ssh.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@ssh.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host ssh.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host ssh.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump ssh.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host ssh.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump ssh.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}

Sandbox:SSH Proxy Service Interim Technical Documentation

2026-03-16T22:03:03Z

GarsonSam:

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| TESTING REQUIREMENTS
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Garson to add some notes in here around the requirements that you have to be connected to the ubcit.tech pool, and have a cwl staging account, in order to test this service
|}

== Scope of Service ==
The '''SSH Proxy Service''' ('''SSHP''') does not provide SSH tunneling for other protocols to be emitted from the '''SSH Proxy Hosts''' - it is not a replacement for the [https://it.ubc.ca/services/email-voice-internet/myvpn UBC myVPN service]. It does support SSH tunneling for other protocols to be emitted from '''SSH Destination Hosts'''.
This service is intended for '''end-user use''' of SSH services. It is not intended for administration of systems over SSH. Remote SSH systems administration should be facilitated through the use of the high-security [https://privacymatters.ubc.ca/esam UBC eSAM (Enhanced System Access Management)] service. eSAM offers session recording, privileged account management, and a host of other security features which make it the right choice for systems administration work.

[[File:SSH Proxy Service Use Cases.png||In-scope and out-of-scope use cases for the SSH Proxy Service.]]

== Connectivity Information ==
{| class="wikitable"
|+
!Purpose
!Host
!Port
|-
|SSH Proxy Host
|http://p01.sshp.test.infosec.it.ubc.ca/
|22
|-
|SSH Key Registration Web Portal
|https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
|443
|}

SSH connections can be made to ssh.infosec.it.ubc.ca port 22. For the PoC, there are no '''intentional''' session timeouts implemented. Should SPS enter production, a formal decision on intentional session timeouts will be made.

{| class="wikitable" width=100% align="center"valign="top"
!style="background: #faecc8;"| Warning
|-
|style="background: #faf6ed; align=left; padding:3px 7px 3px 7px;"|Avoid the use of SSH Agent forwarding! SSH Agent forwarding exposes your authentication to the server you’re connecting to. By default, an attacker with control of the server (i.e. root access) can communicate with your agent and use your key to authenticate to other servers without any notification (i.e. impersonate you). For this reason, one must be careful when using SSH agent forwarding. Defaulting to always forwarding the agent is '''strongly''' discouraged. Note also that while the attacker can use your key as long as the agent is running and forwarded, they cannot steal/download the key for offline/later use. <ref name="Mozilla OpenSSH Guidelines">{{cite web |url=https://infosec.mozilla.org/guidelines/openssh#ssh-agent-forwarding |title=Mozilla OpenSSH Guidelines |publisher=Mozilla}}</ref>
|}

=== Authentication Options ===
{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || This service requires the use of a [https://privacymatters.ubc.ca/learn-about-enhancedcwl UBC Enhanced CWL with Duo MFA].
|}

'''Interactive'''

* Enhanced CWL accounts with Duo MFA.
* MFA required on every authentication.
* Convenient and easy to use - best suited for ad-hoc work.

'''Non-Interactive (Key-based)'''

* Enhanced CWL accounts with SSH keys.
* MFA not required on authentication.
* MFA is required to pre-register your SSH key at https://ssh-proxy.cad.devl.infosec.it.ubc.ca/keys
* Best-suited for heavy users or non-interactive connections.

{| style="border: 1px #98B2C3 solid; padding: 0; border-radius: 0.25rem; padding-right: .3em;"
|-
| ℹ || For the purposes of the PoC, SSH keys will '''not expire'''. However, should SPS enter production, there will be a set key expiration and renewal process.
|}

== SSH Key Handling ==
Do not re-use an existing key for the SSH Proxy Host unless required.

Keys should be generated following the [https://infosec.mozilla.org/guidelines/openssh#key-generation|Mozilla OpenSSH guidelines], as per UBC Information Security Standard M3, section 4.

Example:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ubcsps_$(date +%Y%m%d) -C "UBC key for SPS"

== FAQ ==

==== How can I use a hardware token as MFA when using the SSH Proxy with interactive authentication (no key)? ====
When connecting using interactive authentication, after providing your password you'll be prompted for Duo authentication methods. Instead of choosing a method, simply trigger your hardware key to send the MFA code.
[jbdoe-local@localhost ~]$ ssh -J jbdoe-cwl@ssh.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca
UBC JumpHost
(jbdoe-cwl@ssh.infosec.it.ubc.ca) Password:
(jbdoe-cwl@ssh.infosec.it.ubc.ca) Duo two-factor login for jbdoe-cwl

Enter a passcode or select one of the following options:

1. Duo Push to XXX-XXX-4099
2. Duo Push to iPad Pro (iOS)
3. Phone call to XXX-XXX-4099
4. SMS passcodes to XXX-XXX-4099

Passcode or option (1-4): cccdfabcrrbbnctkqidcrkiirkvgfvtgfdgvvfqnhntfib
Last login: Wed Jan 11 10:08:06 2023 from 206.87.62.99
[jbdoe-dest@foo ~]$

==== How does this align with the [https://privacymatters.ubc.ca/esam UBC Enhanced System Access Management (eSAM) service?] ====
eSAM is used for system-administration tasks and requires VPN with a CWL admin account. eSAM offers session recording, privileged account management, and many other security features which make it the right choice for system administration work. If you're doing sysadmin-type things, eSAM is the way (not just for SSH, either - it can do RDP, web, and more). eSAM offers the highest level of security, stores credentials, and has a relatively high level of friction which end users would not find acceptable.

SPS is intended to be used for user-level tasks - software or services that are used by end-users. Running command line applications, mounting home directories over SSH, doing development work, etc. It offers a suitable level of security for this purpose, and has a significantly reduced level of friction compared to eSAM. It does not store anything beyond SSH public keys, which are not high risk.

== Use Case Patterns ==
(Note - note all of these have been validated with the service at this time. If you test any of these, please let us know what's working/not working).

See the [https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Jump_Hosts_--_Passing_Through_a_Gateway_or_Two Proxies and Jump Hosts section of the OpenSSH Cookbook] for many other scenarios.

=== Interactive Auth to SPS ===
Connecting through SPS interactively with SSH to the destination host can be accomplished transparently via use of the '''-J''' parameter.

$ ssh -J <cwlusername>@ssh.infosec.it.ubc.ca <username>@<destination_host>

==== Example ====
Connect to foo.ubc.ca as user jbdoe-dest using CWL username jbdoe-cwl for SPS:

$ ssh -J jbdoe-cwl@ssh.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca

=== Non-Interactive (Key-based) Auth to SPS ===
Connecting through SPS using key-based auth requires you first create an SPS-specific '''Host''' directive in ~/.ssh/config.

''~/.ssh/config

Host ssh.infosec.it.ubc.ca
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

After that, you can connect using the same '''-J''' parameter used in the Interactive section above.

=== Using SPS via ssh config ===
Connecting with SSH to the destination host can be accomplished transparently via use of the '''ProxyJump''' configuration setting for any given host defined in the ~/.ssh/config file.

''~/.ssh/config

Host <destination_host>
ProxyJump ssh.infosec.it.ubc.ca

However, doing this will result in the ssh.infosec.it.ubc.ca host being passed the local username of the source system, which may not be desired. As such, you may want to also define a '''Host''' section for the SPS host that forces a specific username to be used.

==== Example 1 ====
Connect to foo.ubc.ca through SPS with CWL username of jbdoe-cwl:

''~/.ssh/config
Host ssh.infosec.it.ubc.ca
User jbdoe-cwl

Host foo.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest:

$ ssh jbdoe-dest@foo.ubc.ca

'''Note: ''' This will route ALL ssh connections through SPS from the source host, including those that originate from on-campus.

==== Example 2 ====
Use SPS with an SPS-specific SSH key for all hosts under UBC subdomain foo.ubc.ca, using a CWL username of jbdoe-cwl to login to SPS.

''~/.ssh/config''

Host ssh.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca

With that in place, you can connect to foo.ubc.ca as user jbdoe-dest, without being prompted for your SPS password.

$ ssh jbdoe-dest@foo.ubc.ca

==== Example 3 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca:

''~/.ssh/config

Match Host *.bar.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca

With that in place, you can connect to foo.bar.ubc.ca as user jbdoe-dest (note that this will use whatever your local account username is to auth to SPS):

$ ssh jbdoe-dest@foo.bar.ubc.ca

==== Example 4 ====
Use SPS for all hosts under UBC subdomain bar.ubc.ca except for foo.bar.ubc.ca and only off-campus:

''~/.ssh/config''
Match Host *.bar.ubc.ca,!foo.bar.ubc.ca exec "[\[ `curl --no-progress-meter ifconfig.me` != 142\.103\.* ]]"
ProxyJump ssh.infosec.it.ubc.ca
(Remove the \ - it's necessary here because [ is special.)
Tune the IP address expression to whatever is "on-campus" for you.
{| class="wikitable"

|+ Identity Rubric
|-
! SSH Command Line !! ssh_config !! Local Username !! SPS Username !! Destination System Username !! Login UX
|-
| <code>$ ssh -J ssh.infosec.it.ubc.ca foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-local</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh -J jbdoe-cwl@ssh.infosec.it.ubc.ca jbdoe-dest@foo.ubc.ca</code> || none || <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh jbdoe-dest@foo.ubc.ca</code> ||
Host foo.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-local</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.bar.ubc.ca</code> ||
Host ssh.infosec.it.ubc.ca
User jbdoe-cwl

Match *.bar.ubc.ca
ProxyJump ssh.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Interactive
foo.bar.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host ssh.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Host foo.ubc.ca
User jbdoe-dest
ProxyJump ssh.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Interactive
|-
| <code>$ ssh foo.ubc.ca</code> ||
Host ssh.infosec.it.ubc.ca
User jbdoe-cwl
IdentityFile ~/.ssh/id_ed25519_ubcsps_20221206

Match *.ubc.ca
User jbdoe-dest
IdentityFile ~/.ssh/id_rsa_ubc_20201101
ProxyJump ssh.infosec.it.ubc.ca
|| <code>jbdoe-local</code> || <code>jbdoe-cwl</code> || <code>jbdoe-dest</code> || SPS: Non-Interactive
foo.ubc.ca: Non-Interactive
|}

== Support / Feedback ==
For any questions, comments, suggestions or feedback regarding SPS PoC, please drop an email to [mailto:jagmeet.randhawa@ubc.ca?subject="SSH Proxy Service Feedback" jagmeet.randhawa@ubc.ca]

== References ==
{{Reflist}}