Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm looking to ssh from my localhost to a remote server, and from there to a remote computer. I currently have it set up so that the remote computer and remote server have passwordless ssh-ing set up between them, but if I ssh from my localhost into the server, and then try to ssh to the computer from there, I get:

Enter passphrase for key '/home/user/.ssh/id_dsa': 
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive).

If I try to ssh from a terminal open on the remote server to the remote computer, it works just fine. Does it have something to do with my display not being :0.0, or something else entirely? I've tried xhost +local: but been lost past that.

Thanks

share|improve this question

2 Answers 2

up vote 3 down vote accepted

If both systems have the public key of your local system use -A.

From ssh(1)

-A      Enables forwarding of the authentication agent connection.  This
        can also be specified on a per-host basis in a configuration file.

Also be aware of this warning:

        Agent forwarding should be enabled with caution.  Users with the
        ability to bypass file permissions on the remote host (for the
        agent's UNIX-domain socket) can access the local agent through the
        forwarded connection.  An attacker cannot obtain key material from
        the agent, however they can perform operations on the keys that
        enable them to authenticate using the identities loaded into the
        agent.

The result is that when you auth against the second host the auth is forwarded all the way back to the host where you physically reside.

Example:

me@host0:~ $ ssh -A host1
Last login: Thu Jun 14 11:31:53 2012 from 2001:db8::b0
me@host1:~ $ ssh -A host2
Last login: Thu Jun 14 11:41:05 2012 from 2001:db8::b1
me@host3:~ $ ssh -A host3
Last login: Tue Jun 12 10:46:50 2012 from 2001:db8::b2
me@host3:~ $ 
share|improve this answer
    
So in the event I want to make this extensible and have five or six computers log in to the server (with one username), and then have passwordless access to the remote computer, I'd have to add all of their public keys to both server and remote computer? –  vityav Jun 14 '12 at 21:54
1  
No. Add the public key for only the computer you are physically using to all remote systems. –  bahamat Jun 14 '12 at 21:56
    
I meant if I wanted my laptop, work computer, and tablet to all log into a central server, and from there have passwordless access to another computer, I'd have to pass around all three public keys, which I was hoping to avoid, but should work. Thanks –  vityav Jun 15 '12 at 2:01
    
Yes, true. Or you can use the same secret key on each (although not recommended). I use cfengine to distribute my public key to all hosts. –  bahamat Jun 15 '12 at 18:12

Your agent is unable to pass authentication on to the remote computer. You can port-forward a connection to connect directly to the remote machine if you would like.

See this article on SSH multi-hop and skip to the section about ProxyCommand

in ~/.ssh/config:

Host remotecomputername
  ProxyCommand ssh -q remoteservername nc -q0 remotecomputername 22
share|improve this answer
    
Though very cool to know, it's still giving me a Permission Denied error. I've also tried adding the flags -t and -ax to no avail, and copying the id_dsa files to my localhost didn't help either. –  vityav Jun 14 '12 at 18:01
    
Though the private key unlocks automatically for terminals on the remote server, it doesn't seem to transfer that to my remote login. Is it even possible to do that? –  vityav Jun 14 '12 at 18:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.