First of all, by nested ssh, I mean the following way of using ssh:
ssh usera@Bob 'ssh usera@C'
A wants to login on server
C, but for some reason
C is not directly available to
C's behind a certain FW or NAT or so). Fortunately,
Bob has direct connection to
A can connect to
Bob as well. So, in order to login on
A would actually do the aforementioned thing.
My question here is, will Bob be able to see the communication between A and C in clear, given Bob is the administrator of his server. My guess is yes, but not so sure about my understanding of SSH internals.
The reason I think Bob can see the plaintext is: There are two session keys:
kac, for the outer and nested
ssh command respectively.
kac is unknown to Bob ideally. (Is that true when Bob is the root user?). Anyway, when a message arrives at Bob, it has to be decrypted with
kab, then encrypted with
kac and send to C. So between the encryption and decryption, the plaintext is somewhere in the memory. Bob should be able to see it, not straightforwardly though.