Are you "allowed" to temporarily run an ssh tunnel (or stunnel) on your jumpbox? So connecting from host1 to jumpbox on port XXX would be tunneled to ssh port on host2... Or with netcat (if you can mkfifo)? mkfifo backpipe nc -l 12345 0<backpipe | nc host2 22 1>backpipeBut you will have to trick ssh into accepting your jumpbox "fingerprint"... JD