I can connect to server1 and server2 with ssh. Is it possible to connect to server1 from server2 without copy my private key to server2 with open session with server2 from my local machine?


Yes, when you run the SSH authentication agent on your local workstation and then enable forwarding of the authentication agent connection.

Doing so is not completely secure.

From the manual (man ssh):

-A Enables forwarding of the authentication agent connection. This can also be specified on a per-host basis in a configuration file.

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.

A server admin can also disable agent forwarding with the AllowAgentForwarding no option in the sshd_config.

  • 1
    please see my answer for a secure alternative to agent forwarding
    – RogerFC
    Mar 14 '17 at 15:07

You could configure ssh agent and agent forwarding to do this.


You can use the ProxyJump command in ssh to achieve this:

$ ssh user1@server1 -J user2@server2 

Note that agent forwarding is not recommended as opens you up to some security issues.

  • "SSH Agent Forwarding only works for interactive sessions" - It's my using case and security no matters, but your information definitely useful
    – El Ruso
    Mar 14 '17 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.