How to do multihop ssh with fabric

Question

I have a nat and it has various server So from my local server I want to go to nat and then from nat i have to ssh to other machines

Local-->NAT(abcuser@publicIP with key 1)-->server1(xyzuser@localIP with key 2) nat has different ssh key and each of the server has different ssh key how can i accomplish this type of multihop ssh using fabric I tried using env.roledefs feature but it doesnt seems to be working also I am not sure how to define two ssh keys.I know we can define a list of keys with env.key_filename but issue is will it check each key with each server?How can I be more specific and match a key with one server only

I have tried using command from my local machine fab deploy -g 'ec2-user@54.251.151.39' -i '/home/aman/Downloads/aws_oms.pem' and my script is

from __future__ import with_statement
from fabric.api import local, run, cd, env, execute
env.hosts=['ubuntu@10.0.0.77']
env.key_filename=['/home/ec2-user/varnish_cache.pem']
def deploy():
    run("uname -a")

Answer 1

In order to connect to remote hosts via an intermediate server, you can use the --gateway command-line option :

http://docs.fabfile.org/en/latest/usage/fab.html#cmdoption-g

Or, alternatively, set the env.gateway variable inside your fabfile :

http://docs.fabfile.org/en/latest/usage/env.html#gateway

For more detail information, see:

http://docs.fabfile.org/en/stable/concepts/networking.html#ssh-gateways

Answer 2

It's possible. Double hop to 10.0.0.2 (and list files) via gateway hop 10.0.0.1. Basically, you simply nest the connections with the gateway parameter.

# coding: utf-8

from fabric import Connection

path = '/'
conn1 = Connection(host='user1@10.0.0.1', connect_kwargs={'password': '***'})
conn2 = Connection(host='user2@10.0.0.2', connect_kwargs={'password': '***'}, gateway=conn1)
result = conn2.run(f'''cd {path} && ls -al''', hide=True)
conn2.close()
conn1.close()
msg = "Ran {0.command!r} on {0.connection.host}, got stdout:\n{0.stdout}"
print(msg.format(result))

Please remember to run the SSH connection manually once to introduce the servers to each other!

Install via

pip3 install --upgrade fabric
pip3 install cryptography==2.4.2  # optional to hide some annoying warnings

http://docs.fabfile.org/en/latest/concepts/networking.html

Python 3.6+.