Home / server / Questions / 934642
In Process
blueFast
Asked: 2018-10-10 02:43:35 +0800 CST

SSH from A through B to C, using private key on A

  • 772

These is my scenario:

  • Host C is not accessible from A.
  • Host B is accessible from A.
  • Host C is accessible from B.
  • Both B and C have ~/.ssh/id_rsa.pub (from A) in authorized_keys
  • B does not have the private key (~/.ssh/id_rsa), since it would be a security risk (the key is personal).
  • since B doed not have the private key, it is not possible to login to C from it

How can I use the key in host A to login to host C? Is this possible? I fear not.

(similar but different to this question)

EDIT

What I would need is a way to provide, on-the-fly (stdin or similar), the private key to the ssh hop in B, without it ever touching the filesystem in B. Is this possible?

linux

3 Answers

  1. If you are using a recent version of OpenSSH you can simply type:

    ssh -J B C

    If you are using a slightly older version without -J support you can use a slightly more elaborate syntax:

    ssh -o ProxyCommand='ssh -W %h:%p B' C

    If you need this every time you ssh from A to C it can be useful to add an entry in your .ssh/config file looking like this (in recent versions):

    Host C
   ProxyJump B

    Or like this (in slightly older versions):

    Host C
   ProxyCommand ssh -W %h:%p B

    Using either of the above you can simply type ssh C to open the connection. This is particular useful when you are using ssh indirectly through one of the many tools which utilize ssh for their transport. Not all of these tools provide a straightforward way to pass command line flags to the ssh command.

    • 10

  2. That's rather easy. Just use agent forwarding (-A option on ssh).

    Sample:

    #On machine A use
ssh -A user@<machine_B>
#Then on machine B use
ssh -A user@<machine_C>

    No need for copying private keys all over the place. -A forwards only any SSH Agent requests over to the first machine in the chain, so a private key on machine A can be used as long as you don't switch users on intermediate machines.

    If you change your user on machine B (e.g. with a su foo to user foo), the agent forwarding does not work any longer, as the next connection is done as user foo with it's own keys.

    • 0

  3. I stumbled on this question while looking for the same thing. The solution here with keys looks like:

    ssh -o ProxyCommand="ssh -i /path/proxy.pem -W %h:%p user@proxy_host" -i /path/target.pem user@target_host

    I can't take credit here though, as this solution is from another question, but I have verified that this approach works.

    • 0