2

I have my github.com private ssh key in an ssh-agent on a key server. From my home computer behind NAT I want to run git pull and use my github ssh key.

The only way I know of doing this is to ssh into the key server and forward port 22, then ssh back into my home computer while forwarding the agent, then run git pull in that new shell like so:

home$ ssh keyserver -R10022:localhost:22
keyserver$ ssh -A localhost -p10022
home$ git pull

Is there a simpler way to use the remote ssh key?

2 Answers 2

5

I have used two different approaches in scenarios similar to yours.

  1. Start an agent locally
  2. Forward it to the server
  3. Use ssh-add to add the key from the server to your local agent (optinally with a limited lifetime)
  4. Log out from the server
  5. Use the key from the local agent as many times as you wish

Or

  1. Start an agent locally
  2. ssh server cat keyfile | ssh-add /dev/stdin

If the server is configured in a way that will not let your key get off the server ever, neither of the above approaches will work. In that case there isn't any solution, which is simpler than your own approach. But there are alternatives, which may provide better user-experience and/or security.

This command would open the same pair of ssh connections you used in your own example. But then return to the initiating shell where you can make use of the forwarded agent.

export $(grep -m1 ^SSH_AUTH_SOCK= <(
ssh -n -R10022:localhost:22 keyserver ssh -A localhost -p10022 "'env ; sleep 99999'"))
3
  • I really like both of your approaches. Too bad ssh -A keyserver ssh-add shows my key's password in plain text. I was hoping your first approach could be simplified. Mar 30, 2014 at 3:27
  • 1
    To get the password not to display on the screen, you need to add the -t flag to that command like ssh -At keyserver ssh-add
    – kasperd
    Mar 30, 2014 at 6:07
  • awesome. thanks so much. i'll leave the answer unaccepted a little bit longer to see if there are any more ideas out there. Mar 31, 2014 at 0:41
3

Since OpenSSH 6.7 (2014-10-06), there is an option to achieve the goal of reverse ssh-agent forwarding. The feature is Unix domain socket forwarding.

Example:

export SSH_AUTH_SOCK=~/.ssh/ssh-agent.sock
ssh -NfL $SSH_AUTH_SOCK:/remote/path/to/ssh-agent.sock keyserver

This will forward a local socket to the remote keyserver's ssh-agent socket over ssh and fork in the background.

Note: All the same security warnings apply to this method as for regular agent forwarding found in the man page for ssh(1).
Also, there may be better solutions to your problem than reverse ssh-agent forwarding, like kasperd's answer. This answer is provided as a direct answer to the question for completeness, and not necessarily as the best solution.

1
  • I just used this technique today and it worked well. Thanks! Nov 30, 2021 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .