13

These is my scenario:

  • Host C is not accessible from A.
  • Host B is accessible from A.
  • Host C is accessible from B.
  • Both B and C have ~/.ssh/id_rsa.pub (from A) in authorized_keys
  • B does not have the private key (~/.ssh/id_rsa), since it would be a security risk (the key is personal).
  • since B doed not have the private key, it is not possible to login to C from it

How can I use the key in host A to login to host C? Is this possible? I fear not.

(similar but different to this question)

EDIT

What I would need is a way to provide, on-the-fly (stdin or similar), the private key to the ssh hop in B, without it ever touching the filesystem in B. Is this possible?

Improve this question
9
  • make ssh tunnel over host B.
    – Ipor Sircer
    Oct 9, 2018 at 10:45
  • You say "B does not have the private key (~/.ssh/id_rsa), since it would be a security risk". Why? Are there multiple users that connect to the same account in B? Is it feasible to create multiple accounts in B (one for user) so to have private keys in B, too?
    – Daniele Santi
    Oct 9, 2018 at 10:47
  • @MrShunz not to the same user, but several users can become root ...
    – blueFast
    Oct 9, 2018 at 10:51
  • @IporSircer cool! How? Beware: private key is not in host B.
    – blueFast
    Oct 9, 2018 at 10:51
  • @IporSircer that's what I thought at first, but if I understood correctly, he cannot connect from B to C via keys.
    – Daniele Santi
    Oct 9, 2018 at 10:58

3 Answers 3

Reset to default
11

If you are using a recent version of OpenSSH you can simply type:

ssh -J B C

If you are using a slightly older version without -J support you can use a slightly more elaborate syntax:

ssh -o ProxyCommand='ssh -W %h:%p B' C

If you need this every time you ssh from A to C it can be useful to add an entry in your .ssh/config file looking like this (in recent versions):

Host C
   ProxyJump B

Or like this (in slightly older versions):

Host C
   ProxyCommand ssh -W %h:%p B

Using either of the above you can simply type ssh C to open the connection. This is particular useful when you are using ssh indirectly through one of the many tools which utilize ssh for their transport. Not all of these tools provide a straightforward way to pass command line flags to the ssh command.

Improve this answer
2
  • 4
    You can also automate this by creating ~/.ssh/config (on A), and adding an entry for Host C with the option ProxyJump B (or ProxyCommand ssh -W %h:%p B as appropriate). Then ssh C will do the right thing.
    – Gordon Davisson
    Oct 9, 2018 at 19:16
  • 1
    @GordonDavisson That's a good point and particular useful in case you aren't invoking ssh directly but rather indirectly through another tool which uses ssh.
    – kasperd
    Dec 7, 2018 at 15:08
0

That's rather easy. Just use agent forwarding (-A option on ssh).

Sample:

#On machine A use
ssh -A user@<machine_B>
#Then on machine B use
ssh -A user@<machine_C>

No need for copying private keys all over the place. -A forwards only any SSH Agent requests over to the first machine in the chain, so a private key on machine A can be used as long as you don't switch users on intermediate machines.

If you change your user on machine B (e.g. with a su foo to user foo), the agent forwarding does not work any longer, as the next connection is done as user foo with it's own keys.

Improve this answer
3
  • This will give B access to use any keys in that agent for as long as the connection stays open. There are methods to combine it all into a single command being invoked on A without agent forwarding, which means they will be more secure and usually also more convenient.
    – kasperd
    Oct 9, 2018 at 12:25
  • But just if someone impersonates that user on B. Didn't know about -J, so good point, but does this allow for using different usernames on B than on C? Sometimes we have servers with differing usernames but same keys (e.g. admin_server and admin_poi or something along this line)
    – Marcel1980
    Oct 9, 2018 at 12:34
  • I think you can use a syntax like -J user@hostname (the machine I am on at the moment has a too old version of ssh to have -J so I can't test it right now).
    – kasperd
    Oct 9, 2018 at 12:38
0

I stumbled on this question while looking for the same thing. The solution here with keys looks like:

ssh -o ProxyCommand="ssh -i /path/proxy.pem -W %h:%p user@proxy_host" -i /path/target.pem user@target_host

I can't take credit here though, as this solution is from another question, but I have verified that this approach works.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .