title: SSH Config Dynamic Port with ProxyCommand and BASH Script
body: <p>I've got a server setup to randomise it's SSH Port after a certain amount of time and publish the port to a .txt file available on it's web server. I have then written a simple script on my client which fetches the new port from the web server .txt file and updates a specific hosts Port number in <em>~/.ssh/config</em>. </p>
  
  <p>Because <em>~/.ssh/config</em> cannot parse Bash variables I call the script with ProxyCommand (I am using a JumpHost and the JH Port is the dynamic Port).</p>
  
  <p><strong>My ~/.ssh/config as follows:</strong></p>
  
  <pre><code>Host jumphost
  HostName jumphost.example.com
  Port 51638
  User bob
  StrictHostKeyChecking no
  UserKnownHostsFile=/dev/null
  
  Host myserver
  HostName myserver.com
  Port 2222
  User bob
  ProxyCommand ~/.ssh/get_dynamic_port.sh ssh -W %h:%p jumphost
  </code></pre>
  
  <p><strong>Bash script as follows (get_dynamic_port.sh):</strong></p>
  
  <pre><code>#!/bin/sh
  PORT=$(curl -s http://jumphost.example.com/port.txt)
  OLDIP=`grep -w "jumphost.example.com" -A 1 ~/.ssh/config | awk '/Port/ {print $2}'`
  LINE_NUMBER=`grep -n "jumphost.example.com" -A 1 ~/.ssh/config | grep -v "jumphost.example.com" | awk '{print $1}' FS="-"`
  sed -i'.bak' -e "${LINE_NUMBER}s/$OLDIP/$PORT/" ~/.ssh/config
  </code></pre>
  
  <p>The script works fine and updates the Port for jumphost.example.com but unfortunately I cannot connect, ssh running in debug output below:</p>
  
  <pre><code>macosx:$ ssh -vvv myserver
  OpenSSH_7.9p1, LibreSSL 2.7.3
  debug1: Reading configuration data ~/.ssh/config
  debug1: ~/.ssh/config line 54: Applying options for myserver
  debug1: Reading configuration data /etc/ssh/ssh_config
  debug1: /etc/ssh/ssh_config line 48: Applying options for *
  debug1: Executing proxy command: exec ~/.ssh/get_dynamic_port.sh ssh -W myserver:2222 jumphost
  debug1: identity file ~/.ssh/id_rsa type -1
  debug1: identity file ~/.ssh/id_rsa-cert type -1
  debug1: identity file ~/.ssh/id_dsa type -1
  debug1: identity file ~/.ssh/id_dsa-cert type -1
  debug1: identity file ~/.ssh/id_ecdsa type -1
  debug1: identity file ~/.ssh/id_ecdsa-cert type -1
  debug1: identity file ~/.ssh/id_ed25519 type -1
  debug1: identity file ~/.ssh/id_ed25519-cert type -1
  debug1: identity file ~/.ssh/id_xmss type -1
  debug1: identity file ~/.ssh/id_xmss-cert type -1
  debug1: Local version string SSH-2.0-OpenSSH_7.9
  ssh_exchange_identification: Connection closed by remote host
  </code></pre>
  
  <p>It should be noted that tailing the secure log file on the jumphost server doesn't show any connection attempts which might be a sign as to what is wrong.</p>
  
  <p>The jumphost config works fine without the dynamic port script, and as stated above the script is actually changing the port of the jumphost correctly but then ssh just fails after that.</p>
  
  <p>Any ideas on how to achieve this or what I could be doing wrong would be appreciated. I could just use a crontab entry to run the script every so often to update the jumphost port, but I would prefer to only have the jumphost port updated when a connection is being made to it, just seems a bit cleaner that way.</p>
  
  <p>Thanks :)</p>