Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to be able to connect to a server, start a sudo shell, then use agent forwarding to connect to another server (in order to use SCP to copy files to a protected area). But:

ubuntu@tunnelator:/var/www$ ssh -p 10022 stevebennett@localhost
Last login: Fri Apr  5 10:54:03 2013 from localhost
~ exit
Connection to localhost closed.

ubuntu@tunnelator:/var/www$ sudo ssh -p 10022 stevebennett@localhost
Password:

Presumably, starting the sudo shell is killing the agent forwarding. The difference is this:

debug1: Offering RSA public key: id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 277
debug1: Authentication succeeded (publickey).

versus:

debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Next authentication method: keyboard-interactive

Is there a way to make this work? (The setup is roughly as described here: http://codysoyland.com/2010/jun/6/ssh-tip-automatic-reverse-tunnels-workflow-simplif/)

share|improve this question
    
Maybe this can help: serverfault.com/questions/107187/… –  user167963 Apr 5 '13 at 3:11

1 Answer 1

up vote 1 down vote accepted

Thanks to user157963's suggestion, this turns out to be easy:

sudo -E ssh -p 10022 stevebennett@localhost

Or, to be a bit more selective, you can do this:

sudo su -l -c "export SSH_AUTH_SOCK=$SSH_AUTH_SOCK; ssh -p 10022 stevebennett@localhost"

(Note this only works when su'ing to the root user - it needs to be able to read the original socket file.)

I had mistakenly thought that the $SSH_AUTH_SOCK environment variable was already being preserved. Tip: the following command doesn't tell you anything useful :)

sudo echo $SSH_AUTH_SOCK

Whereas this does:

sudo bash -c 'echo $SSH_AUTH_SOCK'
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.