Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I'm fairly sure this will have been asked before, I have found similar questions but I do not fully understand how to apply them to my situation. So, sorry for asking again.

We have a number of servers located in a data centre which have firewall rules only allowing SSH connections to them from our work external IP. They also only accept authentication with SSH keys. Can I connect to one of these servers via another machine at work and have the key passed on from my machine (at home) for authentication?

Is this an SSH tunnel, or is that something else?

Thanks for your help.

share|improve this question

marked as duplicate by Dave M, Falcon Momot, Jenny D, mdpc, Ward Mar 30 at 1:29

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
What did you not understand about the other Q&A you saw ? –  Iain Mar 28 at 17:48
    
look into SSH agent forwarding –  LinuxDevOps Mar 28 at 17:49

1 Answer 1

up vote 5 down vote accepted

You can use the ssh ProxyCommand functionality for this.

Assume serverA is your jump host, and serverB is the ultimate server you want to connect to. Add the following to your ~/.ssh/config file:

Host serverB 
  Hostname serverB.example.com
  User jimbob
  ProxyCommand ssh serverA.example.com nc %h %p 2> /dev/null

Then from your workstation, just issue this command:

$ ssh serverB
share|improve this answer
    
Thanks for the reply and thanks for explaining how to connect as that's what I didn't understand in serverfault.com/questions/255613/…. This seems to work perfectly for servers where I login with a password, but it doesn't seem to be passing on my public key to the final server. –  Luke Cousins Mar 28 at 19:27
    
There's no reason this won't work with key auth. If it's not working, there's something else going on. With the above command, there is no "passing on your key", as happens with ssh-agent forwarding. This is actually redirecting the network connection directly to the destination server. –  EEAA Mar 28 at 19:30
    
That's very strange. Please see this image which shows initially connecting to the "poodle" server directly where the key authentication works. Then I exit and try again through the alias created in the config file and it fails (the key is used to connect to the "serverA" server without a password). See this image showing my config file. I really appreciate your help. –  Luke Cousins Mar 28 at 19:44
    
Is the username you use the same on both the jump host as well as your destination server? –  EEAA Mar 28 at 19:46
    
No, it is not. Does it need to be? I could create a new account on the jump host with the same username. Or can we do it without doing that? Thanks. –  Luke Cousins Mar 28 at 19:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.