I'm trying to ssh from my machine to another machine and from there to a third machine. When I do it manually, it works like this:

localhost$ scp ~/.ssh/id_rsa myuser@myhost.something.something.com:.
localhost$ ssh myuser@myhost.something.something.com
myhost.something.something.com$ ssh -i id_rsa myuser@$ 

But I would like to do it directly, in one step. And I want my SSH keys from localhost to forward to the third machine. I thought this would work, but it doesn't:

localhost$ ssh -A -t myuser@myhost.something.something.com ssh
Permission denied (publickey).
Connection to myhost.something.something.com closed.

Why? How can I do this in a single command from localhost? Here is some more detail you can see when I use the verbose flag:

localhost$ ssh -v -A -t myuser@myhost.something.something.com ssh

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to myhost.something.something.com [X.X.X.X] port 22.
debug1: Connection established.
debug1: identity file /home/myuser/.ssh/id_rsa type 1
debug1: identity file /home/myuser/.ssh/id_rsa-cert type -1
debug1: identity file /home/myuser/.ssh/id_dsa type -1
debug1: identity file /home/myuser/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 62:d2:58:47:f7:c6:21:b4:a1:b0:cf:4e:44:42:e4:9a
debug1: Host 'myhost.something.something.com' is known and matches the RSA host key.
debug1: Found key in /home/myuser/.ssh/known_hosts:255
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/myuser/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to myhost.something.something.com ([X.X.X.X]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Requesting authentication agent forwarding.
debug1: Sending command: ssh
debug1: client_input_channel_open: ctype auth-agent@openssh.com rchan 2 win 65536 max 16384
debug1: channel 1: new [authentication agent connection]
debug1: confirm auth-agent@openssh.com
Permission denied (publickey).
debug1: channel 1: FORCE input drain
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 2
debug1: channel 1: free: authentication agent connection, nchannels 1
Connection to myhost.something.something.com closed.
Transferred: sent 3532, received 3312 bytes, in 4.4 seconds
Bytes per second: sent 796.1, received 746.6
debug1: Exit status 255
  • Why the downvote??? – Saqib Ali Mar 25 '16 at 4:47
  • You will need to look at your server side logs. – Iain Mar 25 '16 at 7:10
  • Could you run the ssh-add -l command and post the output here? – Jander Mar 25 '16 at 7:57

If you want to forward connection to your authentication agent, you need to have the authentication agent running on your machine. You can check it using ssh-add -l. If it is not running, start it and add the keys:

eval `ssh-agent`
ssh-add ~/.ssh/id_rsa
# or other keys you want to use from the other server

and then after connecting to the other server with -A switch, you will be able to authenticate using this key further:

local     $ ssh -A myuser@myhost.something.something.com
something $ ssh-add -l                     # should list your key
something $ ssh

But what you are really trying to achieve is something different. You want to use first host as a jumpbox to connect to the second one and it can be made much more convenient using ProxyCommand:

ssh -oProxyCommand="ssh -W" myuser@myhost.something.something.com

or better with .ssh/config:

Host something
  Hostname myhost.something.something.com
  User myuser
Host second
  User myuser
  ProxyCommand ssh -W %h:%p something

and then you will get there just using

ssh second
  • Not only is ProxyCommand more convenient, it is also more secure. The private key is better protected that way. With agent forwarding the jump host could use the key to authenticate to any other host. Using ProxyCommand without any agent forwarding eliminates that weakness. Moreover when using ProxyCommand it is possible to harden the configuration of the jump host much more against attacks from outside. – kasperd Apr 4 '16 at 10:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.