Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have 2 servers. I can connect to server B only using server A. In my ~/.ssh/config file:

Host serverB
  Hostname serverb
  User root
  ForwardAgent yes
  Port 22
  ProxyCommand ssh user@serverA nc %h %p

When I login to serverA and type ssh root@serverB It connects without asking for password, but when I type ssh ServerB on my local machine, it asks for ServerB's password. Why?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

ProxyCommand gives just a tunnel to pipe the outer ssh connection through.

When you do ssh serverB from serverA, you're probably using a key on your account on serverA.

When you do ssh serverB from your client machine, the fact that you're connecting via that nc command started on serverA is not going to magically give you access to the keys on serverA.

You'll need to add serverA's keys to your client agent.

For instance:

ssh-add <(ssh serverA 'cat .ssh/id_rsa')

To add the key in .ssh/id_rsa on serverA (ksh93/bash/zsh syntax above).

share|improve this answer
    
Not that this would not work, but if you do this then you have to give an intermediate hop access to your endpoint. i.e. now ServerA can get to ServerB without knowing ServerB's password - where you really just want Client to be able to access ServerB without password. –  Iwan Aucamp Oct 2 at 9:52

Few things:

  1. How sure are you its asking for serverB's password ? It might be asking for serverA's
  2. You don't need to forward your agent - you will be handshaking directly with serverB in this case - it wont be serverA that is handshaking with serverB
  3. You don't need to add key from serverA to your client - again you will be talking directly to serverB - just through serverA - so cant see point in doing this - and its also a security hazard.
  4. What happens when you ssh serverA - does it ask for a password ? if it does - have you considered installing your public key on serverA's authorized_hosts ? ssh-copy-id serverA ?
  5. run with -vvv and pastebin/filebin/post output
share|improve this answer

I do not have a full answer, just some things to check. Verify the permissions of the home directories of the unix user on both boxes. Verify the directory permissions to $HOME, to $HOME/.ssh, and all the files under .ssh in both boxes. Check the versions of ssh. Compare the ssh config files for both boxes also.

But this has happened to me many times in the past. The two things that have caused it?
1. incorrect permissions in directories. 2. A bad server key in $HOME/.ssh/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.