3

Im trying to set up SSH forwarding like this

osx > debianA > debianB

I can connect to debianA fine, using ssh -A and it has the following env vars when i do:

SSH_AGENT_PID=1543
SSH_AUTH_SOCK=/tmp/ssh-giwdYY1542/agent.1542
SSH_CLIENT='92.233.199.x 38954 22'
SSH_CONNECTION='92.233.199.x 38954 108.171.179.x 22'
SSH_TTY=/dev/pts/0

When i try to connect to debianB, the agent is not used!

ssh -v output ends with:

debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/nic/.ssh/id_rsa
debug1: Trying private key: /home/nic/.ssh/id_dsa
debug1: Next authentication method: password

Then im asked for a password.

I have not set any ForwardAgent no directives in ssh_config and dont have a .ssh/config at all. sshd_config has not got AllowAgentForwarding in it. I have tried all of these directives as yes also.

debianA and debianB both have identical ssh_config and sshd_config (verified with diff) so the really weird thing is connecting OSX > debianB > debianA works fine!!

Im totally out of ideas! Has anyone come across this before?

Cheers! NFV

Update 1

One other thing i noticed is that when connecting osx > debianA the last thing it does in the preamble is spit out the Agent pid:

Nics-iMac:~ nic$ ssh -A nic@cloud01
Linux cloud01 2.6.32-5-xen-amd64 #1 SMP Tue Mar 8 00:01:30 UTC 2011 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
You have new mail.
Last login: Tue Nov 27 06:42:47 2012 from xxx
Agent pid 717  <<< HERE ***********
nic@cloud01:~# 

debianB does not do this, otherwise the preamble is identical, could this be a clue?

NFV

2 Answers 2

1

On debianB, check the contents and permissions of ~/.ssh/authorized_keys. sshd will also whine in the logs if the permissions are wrong (too wide).

1
  • Thanks, ive checked this file and both servers have only one entry, my id_rsa.pub from the mac. Also monitored the syslogs of both servers while connecting and nothing strange appearing.
    – nfvindaloo
    Nov 27, 2012 at 12:23
0

Figured this one out, I had eval ${ssh-agent} at the foot of /etc/profile, must have been overwriting settings from the forwarded agent.

Thanks NFV

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .