I need to do a rsync from a target server with a server in the middle and I have the same public key on both the target and middle server. I want to use that key so I don't have to do password authentication.

local --ssh--> middle --ssh--> target

Reading Method 1 of Using rsync through a firewall makes it seems like this is doable but I have been able to figure out the ssh part of the syntax of the command yet.

When I try

ssh -i $KEY -A user@middle ssh user@target

I get

Permission denied, please try again.
Permission denied, please try again.
Permission denied (publickey,password).

Clearly the agent forwarding isn't happening as I was expecting it to.

Ideally I'd like to fit it all in one command without have to put anything in ~/.ssh/config files. What are all of the steps to do an rsync in this situation?

Thanks, Everett

  • I assume you're doing someting along the lines of rsync -av -e "ssh -A user@middle ssh user@target" [rest of the rsync command] ? And that doesn't work?
    – Joris
    Aug 20, 2010 at 5:16
  • Did you start ssh-agent and add your identity(s)? The '-A' will only "carry" identities loaded into the agent. Aug 20, 2010 at 19:41
  • Yep. First "ssh-add $KEY" then "ssh-agent" finally "ssh -A user@middle ssh user@target" and I still get the Permission denied. Aug 20, 2010 at 19:55
  • A big part of the problem is that my public key on target had a copy/paste error so I couldn't do passwordless authentication to target in the first place. Now that it's fixed the accepted answer below worked for me. Thanks to all for the help. Aug 20, 2010 at 20:43

2 Answers 2


The '-A' will only "carry" identities loaded into ssh-agent. ('-i' on the command won't be enough.)

How about this something like this;

ssh-agent sh -c "ssh-add test_ident; rsync -avr --rsh='ssh -TA hostA ssh -TA ' foo/ hostB:/var/tmp/foo/"
  • 1
    This works for me. For anyone following along substitute $KEY for test_ident, user@middle for hostA and target for hostB Aug 20, 2010 at 20:46

Personally I do this in two hops with the following script:

ssh -fN root@middle.foo -L2211:target.foo:22
rsync "-e ssh -p 2211" /Users/me/dir1/ root@localhost:/backup/dir1/ -avz --progress --delete-after
rsync "-e ssh -p 2211" /Users/me/dir2/ root@localhost:/backup/dir2/ -avz --progress --delete-after

mod as required.

It seemed easier than playing with the rsync options and if your target and middle have your key you shouldn't be prompted.

  • Doing a "ssh -i $KEY -fN root@middle -L2211:target:22" works without prompting me for a password but when I try "rsync -e "ssh -p 2211" /dir/on/local/ root@localhost:/dir/on/target/ -avz --progress" I get asked for root@localhost's password. What could I be missing? Aug 20, 2010 at 15:59
  • See my last comment on the question. Aug 20, 2010 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.