0

I have a network topology like this:

Laptop -> Bastion -> Destination

Bastion and Destination are EC2 instances using the same SSH key for SSH access. However, Destination cannot be accessed from the Internet. Its IP address is visible only to Bastion.

I am able to connect to the Bastion and use agent forwarding to pass the SSH key over and then connect separately from the Bastion to the Destination server. However, I'd like to configure my .ssh/config file in such a way that I can SSH to the Destination server using one command from the laptop. My current .ssh/config file looks like this:

Host Bastion
  Hostname <redacted>
  IdentityFile ~/.ssh/mykey.pem

Host Destination
  Hostname <redacted>
  User ubuntu
  ProxyCommand ssh -A bastion-dev -W %h:%p

But when I run

ssh -A ubuntu@Destination

SSH responds with:

Permission denied (publickey).
ssh_exchange_identification: Connection closed by remote host

How do I correctly pass the SSH key from my local to the Bastion server without having to store it on the server? Can I configure all this via .ssh/config file so that I can log into the Destination server with a single command?

4

Debug with one or more ssh -v flags from from the client and check the logs on the relevant server to see where the problem is.

All too frequently I have different keys for different customers, sites and projects, and I run into a MaxAuthTries setting of the remote ssh server when ssh-agent is still trying every potential key and hasn't reached the correct one yet. Check you server logs for that.

Also typically the username on my workstation won't match to the one that gets assigned on either Bastion or Destination so I prefer to set all settings explicitly in my configs. That way I won't need to use any commandline flags and can simply type ssh Destination and be done with.

Host Bastion
    Hostname bastion.example.com
    User hbruijn-adm
    ForwardAgent yes
    AddKeysToAgent yes
    UseKeychain yes                                  # Specific to OS X 
    IdentityFile ~/.ssh/id_rsa.bastion

Host Destination
    Hostname destination.example.com
    User ubuntu 
    ForwardAgent yes
    AddKeysToAgent yes
    UseKeychain yes                                  # Specific to OS X
    IdentityFile ~/.ssh/id_rsa.destination
    ProxyJump Bastion

ProxyJump is a relatively new setting that I find somewhat more intuitive to use then a ProxyCommand.

  • Thank you. With your advice, I was able to debug the issue. My problem was a silly one - I was connecting to the wrong server. One that doesn't have the ubuntu user. – pkout May 15 '18 at 18:53
  • nice, didn't notice ProxyJump , elegant... – tonioc May 16 '18 at 12:56
  • AFAIK you do not need to use ForwardAgent yes, actually you should set it to no instead. Because you use ProxyJump, you do not need it, and it is unsafe anyway. You should try it if that work the same. – Huygens Apr 12 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.