I have a network topology like this:
Laptop -> Bastion -> Destination
Bastion and Destination are EC2 instances using the same SSH key for SSH access. However, Destination cannot be accessed from the Internet. Its IP address is visible only to Bastion.
I am able to connect to the Bastion and use agent forwarding to pass the SSH key over and then connect separately from the Bastion to the Destination server. However, I'd like to configure my
.ssh/config file in such a way that I can SSH to the Destination server using one command from the laptop. My current
.ssh/config file looks like this:
Host Bastion Hostname <redacted> IdentityFile ~/.ssh/mykey.pem Host Destination Hostname <redacted> User ubuntu ProxyCommand ssh -A bastion-dev -W %h:%p
But when I run
ssh -A ubuntu@Destination
SSH responds with:
Permission denied (publickey). ssh_exchange_identification: Connection closed by remote host
How do I correctly pass the SSH key from my local to the Bastion server without having to store it on the server? Can I configure all this via
.ssh/config file so that I can log into the Destination server with a single command?