title: CanonicalHostname and ssh connections through a jumphost
body: <p>Say I have an internal subdomain named <code>internal.sub.domain.net</code> with hosts like <code>foo.internal.sub.domain.net</code> and <code>bar.internal.sub.domain.net</code>. Furthermore, these hosts are only accessible from the outside world through the jumphost <code>internal.sub.domain.net</code>. Thus, the following <code>~/.ssh/config</code> allows me to directly connect to either of the internal hosts from outside:</p>
  
  <pre class="lang-sh prettyprint-override"><code>Host foo bar
          HostName %h.internal.sub.domain.net
          ProxyJump internal.sub.domain.net
  </code></pre>
  
  <p>This is fine for a subdomain with just only a couple of hosts, but it quickly becomes rather unmaintainable if the number of hosts is large and / or changes occasionally. But wildcards may come to the rescue:</p>
  
  <pre class="lang-sh prettyprint-override"><code>Host *.internal.sub.domain.net
          ProxyJump internal.sub.domain.net
  </code></pre>
  
  <p>This avoids the maintenance issue, but forces to always specify the fully qualified hostname to connect, which is rather tedious. From looking at the ssh_config man-page, the <code>CannonicalizeHostname</code> and <code>CannonicalDomains</code> options seems to fix that:</p>
  
  <pre class="lang-sh prettyprint-override"><code>CannonicalizeHostname always
  CannonicalDomains internal.sub.domain.net
  Host *.internal.sub.domain.net
          ProxyJump internal.sub.domain.net
  </code></pre>
  
  <p>But this would only work if the name lookup for the host that is to be connected succeeds. But as these hosts are internal by definition, it is no surprise that name resolution fails.</p>
  
  <p>A not really helpful but very illustrative hack is to fake successful name resolutions by just adding all the internal hosts as aliases for e.g. <code>127.0.0.1</code> to <code>/etc/hosts</code>, i.e. adding the following line to <code>/etc/hosts</code>:</p>
  
  <pre><code>127.0.0.1 foo.internal.sub.domain.net bar.internal.sub.domain.net
  </code></pre>
  
  <p>With that line in place, the last <code>~/.ssh/config</code> works like a charm. But apart from the fact that this would be quite a hack, it just only shifts the maintenance issue form <code>~/.ssh/config</code> to <code>/etc/hosts</code>.</p>
  
  <p>As the described scenario should not be so uncommon, is there a way to make it work? To phrase it in one sentence again:</p>
  
  <p>I want to be able to ssh to <em>all</em> internal hosts that live in the <code>internal.sub.domain.net</code>, i.e. that are only accessible through the <code>internal.sub.domain.net</code> jumphost <em>without</em> having to list each of these hosts somewhere, as they may frequently be added or removed from the internal domain and <em>without</em> being forced to always type their fully qualified hostnames.</p>