Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So the following two things should both be possible to do with ssh the question is just how difficult they would be and I'm hoping someone can give me an easy answer.

1) Suppose I have several machines A,B,C that I use (locally) and consider trustworthy (we assume that no port/memory monitoring occurs while I'm connected to either host) and enable mutual passwordless login between them. Using A,B,C I want to be able to access a host of other machines E_1...E_n,F_1..F_n,G_1...G_n using ssh keys from any of these hosts but I don't want to add the keys for all 3 hosts to all the workstations. For instance E_1..E_n might be servers at work and while I can add my workstation key to those computers they don't want the key from my home environment similarly F_1..F_n might be my home network and I know that a trusted colleague with an appreciation of pranks has access to my work keys and C might be a work laptop which needs passwordless access to G_1...G_n for time critical tasks but my employer wants to be sure that he can block any access to high security machines E_1...E_n by shutting down my workstation.

ssh-agent forwarding allows me to connect to any of E...G securely by going through the two other `trusted' intermediaries. If I only had one trusted intermediary I could even make it look transparent but with two intermediaries I have to specify one for each destination and the whole thing starts getting complicated if there are lots of names.

Is there an easy way to reverse forward an ssh-connection so that at A,B or C I can ssh into the other two machines and forward those connections back through my machine so I can directly login to any of my destinations (but without ever copying the other two keys to my current box letting my employer feel in control and keeping the prankster from ever having an unlocked key of mine he can use to cause trouble.)?

I'm guessing that if I ran keychain and then created a shell script that ran a reverse ssh connection back to my location when I logged in via ssh might work since keychain would see those agent connections and inherit them letting me at another terminal pass authentication back to the remote machines. It's not obvious how to do this, however, since you don't want infinite recursion nor force me to keep the local key forwarded to both remote machines (i.e. if the prankster becomes root on my workstation he shouldn't have a socket he can hijack to use my home key to have fun).

Any ideas?

Also, it occurs to me there is no reason I should have to enter a password to unlock ssh keys on my trusted remote systems. After all possessing any of the secret keys in question should be enough to convince the remote system to safely unlock it's private keys WITHOUT ever handing the unlocked keys to any remote system.

Theoretically, I should be able to create 3 versions of each of my private keys. One for local use, and one that each remote machine can help unlock. In particular, one could leave these private keys without a password but encrypt them first with a secret kept locally and then with a private key beloning to one of the remote trusted systems. The setup could then decrypt that private key by passing it to the remote trusted system who would remove the first layer of encryption and pass it back and the recieving machine would use it's local secret to finish decrypting the key.

What I want to know is if this theoretical solution has been implemented in practice?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.