config for using git via ssh on jump host

Question

With a private key that is only available on a laptop (alice), is there a way to use that key for authentication with gitlab from a server (bob). (Minor, I think, complication being a jump host between alice and bob.)

alice --> jump --> bob --> gitlab

The ~/.ssh/config on alice is currently:

Host *
  PKCS11Provider /usr/lib/ssh-keychain.dylib

Host jump
  HostName jump01.example.org

Host bob
  HostName bob.example.org
  ProxyJump jump

I've got the public key from alice's token on gitlab, and I'd like to use it with git commands from bob. As in...

alice:~ $ ssh bob
Last login: Fri Aug 27 20:33:56 2021
bob:~ $ git clone [email protected]:my/repo.git

where I've got no key pair on bob.

Answer 1

You have to have some trust that bob can't be abused, but the simple answer is to run an ssh-agent, and use agent forwarding.

Start an agent on alice, add your PKCS11Provider using ssh-add -S then configuring agent forwarding in your config.

Host bob
  ForwardAgent yes
  HostName bob.example.org
  ProxyJump jump

See the man pages for ssh-agent, ssh-add, and ssh_config for details about the PKCS11 providers, and agent forwarding.

Minor, I think, complication being a jump host

Because of how ProxyJump works, it is not a complication, and literally doesn't matter at all. From the perspective of the ssh client on Alice, it acts exactly like you made a direct connection to Bob.