Home / server / Questions / 504799
In Process
Collin Anderson
Asked: 2013-05-04 06:32:26 +0800 CST

Reverse ssh-agent forwarding. Using a remote ssh key

  • 772

I have my github.com private ssh key in an ssh-agent on a key server. From my home computer behind NAT I want to run git pull and use my github ssh key.

The only way I know of doing this is to ssh into the key server and forward port 22, then ssh back into my home computer while forwarding the agent, then run git pull in that new shell like so:

home$ ssh keyserver -R10022:localhost:22
keyserver$ ssh -A localhost -p10022
home$ git pull

Is there a simpler way to use the remote ssh key?

ssh

2 Answers

  1. I have used two different approaches in scenarios similar to yours.

    1. Start an agent locally
    2. Forward it to the server
    3. Use ssh-add to add the key from the server to your local agent (optinally with a limited lifetime)
    4. Log out from the server
    5. Use the key from the local agent as many times as you wish

    Or

    1. Start an agent locally
    2. ssh server cat keyfile | ssh-add /dev/stdin

    If the server is configured in a way that will not let your key get off the server ever, neither of the above approaches will work. In that case there isn't any solution, which is simpler than your own approach. But there are alternatives, which may provide better user-experience and/or security.

    This command would open the same pair of ssh connections you used in your own example. But then return to the initiating shell where you can make use of the forwarded agent.

    export $(grep -m1 ^SSH_AUTH_SOCK= <(
ssh -n -R10022:localhost:22 keyserver ssh -A localhost -p10022 "'env ; sleep 99999'"))
    • 5

  2. Since OpenSSH 6.7 (2014-10-06), there is an option to achieve the goal of reverse ssh-agent forwarding. The feature is Unix domain socket forwarding.

    Example:

    export SSH_AUTH_SOCK=~/.ssh/ssh-agent.sock
ssh -NfL $SSH_AUTH_SOCK:/remote/path/to/ssh-agent.sock keyserver

    This will forward a local socket to the remote keyserver's ssh-agent socket over ssh and fork in the background.

    Note: All the same security warnings apply to this method as for regular agent forwarding found in the man page for ssh(1).
    Also, there may be better solutions to your problem than reverse ssh-agent forwarding, like kasperd's answer. This answer is provided as a direct answer to the question for completeness, and not necessarily as the best solution.

    • 2