Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a simple way to SSH from my local machine, A, through a proxy, B, to a destination host, C. The private key that goes with the public key on C is on B, and I can't put that key on my local machine. Any tips?

Also, I'd like to be able to do this using ~/.ssh/config.


share|improve this question
Are you saying you want to ssh from A to B, and then SSH to C ? Or is proxy a true pass-thru situation? – thinice Dec 3 '11 at 5:25
I want to ssh from A to C, passing through B. My answer below works for the passing through part, but it still tries to look for the IdentityFile on my local computer instead of on B, the pass-through host. – DrewVS Dec 6 '11 at 18:03

Check if following is working.

ssh -t B ssh C

Use following command if you want to use key stored on B.

ssh -t B ssh -i /path/to/identity_on_B C

Here we are specifying command i.e ssh -i /path/to/identity_on_B C to be executed on B instead of a login shell.

share|improve this answer
This works but it does not pick up the IdentityFile from B. It still looks on A. – DrewVS Dec 6 '11 at 18:05
@DrewVS I have updated the answer. Please check if it is working for you. – Sachin Divekar Dec 6 '11 at 18:41
Sachin, very clever. That worked perfectly. Thanks so much! – DrewVS Dec 7 '11 at 19:06
@DrewVS glad to hear that it worked for you. so please accept the answer. – Sachin Divekar Dec 7 '11 at 19:10
However, it looks like this does not work with password protected rsa keys. The password input is hidden, forcing the user to have to add the key to their ssh-key in order for this approach to work. Any ideas? – DrewVS Dec 7 '11 at 21:03


    ssh       ssh
A ------> B ------> C
    ^          ^
 using A's   using B's
 ssh key     ssh key


  • A is running ssh-agent;
  • A can access B;
  • B can access C;
  • A's ssh public key is present in B:~/.ssh/authorized_keys
  • B's ssh public key is present in C:~/.ssh/authorized_keys

In ~/.ssh/config on A, add

Host C
    ProxyCommand ssh -o 'ForwardAgent yes' B 'ssh-add && nc %h %p'

If your ssh private key on B is in a nonstandard location, add its path after ssh-add.

You should now be able to access C from A:

A$ ssh C
share|improve this answer

I've worked this out now. Here is the solution, which is rather straightforward. I should have seen it sooner:


Host B
  User myuser
  IdentityFile ~/.ssh/rsa_key
  ControlMaster auto
  ControlPath ~/.ssh/socket/master-%l-%r@%h:%p

Host C.*
  User customer_username
  Port customer_port
  IdentityFile remote/path/to/ssh/key
  ForwardAgent yes
  ProxyCommand ssh accessable.server nc %h %p

Host C.server-1

'B' is the Proxy server that you are jumping through. It should be configured as you normally would configure access to a server.

'C' is the destination host. It needs to be configured to use 'B' in the connection process. The identity file in 'C' is the path to the ssh-key on 'B'. The ProxyCommand uses Netcat to open the connection to 'C' from 'B'. Netcat, or nc, will need to be installed on 'B'.

Hope this helps others.

share|improve this answer
I spoke too soon. This solution does not see to work. The key had been loaded in the ssh-agent, so I thought it was working. In the above, the key for C still needs to be on A, not B. – DrewVS Dec 6 '11 at 17:36
up vote 2 down vote accepted

My other answer is not completely correct. The fact is there is no way to use ~/.ssh/config to automatically use an identity file on a jump box instance. What I had to do was write a simple script to basically list my ssh keys on the remote instance, and then add the one I selected to my local ssh agent. This is not very clean, but allows me to keep all keys on a remote location rather than locally.

Here's the script if anyone is interested:


require "rubygems"
require "fileutils"

# Get key list
key_list = (`ssh jumpbox "cd ~/.ssh/ ; ls id_rsa*" | sed 's/id_rsa_/  /g' | sed     's/id_rsa//g'`)
puts ' '
puts 'Available customer keys:'
puts key_list

# Get customer name input
puts ' '
puts 'Enter customer name: '
customer_name = gets.chomp

# Add key to ssh-agent
key_name = "~/.ssh/id_rsa_#{customer_name}"
puts ' '
puts "Adding #{key_name} to local ssh-agent"
`ssh jumpbox "ssh-add ~/.ssh/id_rsa_#{customer_name}"`
exit 0
share|improve this answer
I think the adding of a key can be treated as idempotent thereby eliminating the need for get key list. – dmourati Jun 26 '15 at 15:15
#!/usr/bin/env bash


scp -P $target_port -o ProxyCommand="ssh -o 'ForwardAgent yes' $bastion_user@$bastion_host -p $bastion_port 'ssh-add ~/.ssh/*.rsa && nc %h %p'" /tmp/x.txt $target_user@$target_host:/tmp/
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.