Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a simple way to SSH from my local machine, A, through a proxy, B, to a destination host, C. The private key that goes with the public key on C is on B, and I can't put that key on my local machine. Any tips?

Also, I'd like to be able to do this using ~/.ssh/config.

Thanks!

share|improve this question
1  
Are you saying you want to ssh from A to B, and then SSH to C ? Or is proxy a true pass-thru situation? –  thinice Dec 3 '11 at 5:25
    
I want to ssh from A to C, passing through B. My answer below works for the passing through part, but it still tries to look for the IdentityFile on my local computer instead of on B, the pass-through host. –  DrewVS Dec 6 '11 at 18:03
add comment

3 Answers

I've worked this out now. Here is the solution, which is rather straightforward. I should have seen it sooner:

~/.ssh/config:

Host B
  HostName 1.2.3.4
  User myuser
  IdentityFile ~/.ssh/rsa_key
  ControlMaster auto
  ControlPath ~/.ssh/socket/master-%l-%r@%h:%p

Host C.*
  User customer_username
  Port customer_port
  IdentityFile remote/path/to/ssh/key
  ForwardAgent yes
  ProxyCommand ssh accessable.server nc %h %p

Host C.server-1
  HostName 2.3.4.5

'B' is the Proxy server that you are jumping through. It should be configured as you normally would configure access to a server.

'C' is the destination host. It needs to be configured to use 'B' in the connection process. The identity file in 'C' is the path to the ssh-key on 'B'. The ProxyCommand uses Netcat to open the connection to 'C' from 'B'. Netcat, or nc, will need to be installed on 'B'.

Hope this helps others.

share|improve this answer
    
I spoke too soon. This solution does not see to work. The key had been loaded in the ssh-agent, so I thought it was working. In the above, the key for C still needs to be on A, not B. –  DrewVS Dec 6 '11 at 17:36
add comment

Check if following is working.

ssh -t B ssh C

Use following command if you want to use key stored on B.

ssh -t B ssh -i /path/to/identity_on_B C

Here we are specifying command i.e ssh -i /path/to/identity_on_B C to be executed on B instead of a login shell.

share|improve this answer
    
This works but it does not pick up the IdentityFile from B. It still looks on A. –  DrewVS Dec 6 '11 at 18:05
    
@DrewVS I have updated the answer. Please check if it is working for you. –  Sachin Divekar Dec 6 '11 at 18:41
    
Sachin, very clever. That worked perfectly. Thanks so much! –  DrewVS Dec 7 '11 at 19:06
    
@DrewVS glad to hear that it worked for you. so please accept the answer. –  Sachin Divekar Dec 7 '11 at 19:10
    
However, it looks like this does not work with password protected rsa keys. The password input is hidden, forcing the user to have to add the key to their ssh-key in order for this approach to work. Any ideas? –  DrewVS Dec 7 '11 at 21:03
show 5 more comments
up vote 1 down vote accepted

My other answer is not completely correct. The fact is there is no way to use ~/.ssh/config to automatically use an identity file on a jump box instance. What I had to do was write a simple script to basically list my ssh keys on the remote instance, and then add the one I selected to my local ssh agent. This is not very clean, but allows me to keep all keys on a remote location rather than locally.

Here's the script if anyone is interested:

#!/usr/bin/ruby

require "rubygems"
require "fileutils"

# Get key list
key_list = (`ssh jumpbox "cd ~/.ssh/ ; ls id_rsa*" | sed 's/id_rsa_/  /g' | sed     's/id_rsa//g'`)
puts ' '
puts 'Available customer keys:'
puts key_list

# Get customer name input
puts ' '
puts 'Enter customer name: '
customer_name = gets.chomp

# Add key to ssh-agent
key_name = "~/.ssh/id_rsa_#{customer_name}"
puts ' '
puts "Adding #{key_name} to local ssh-agent"
`ssh jumpbox "ssh-add ~/.ssh/id_rsa_#{customer_name}"`
exit 0
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.