I'm trying to ssh on to an ec2 instance via an internal server that actually has the key that can access the machine.

The target machine, does not have a fixed ip, ie, it is a beanstalk machine, so I have a script that returns the ips for my required environment.

I have the following so far, but I can't seem to get it to work:

# The gateway machine. I can ssh this directly from my machine.
Host production
     HostName <ip>
     User <user>

# The ip returned by the instancefinder can only be ssh'ed to via the gateway server ie, "production"
Host production-eb:*
     User ec2-user
     ProxyCommand ssh production nc -q 10 -w 10 $(~/bin/instancefinder %h | tail -n1) %p

If I provide the IdentityFile for the production-eb:* config, it looks for it on my own machine. How do I get it to use this key on the gateway machine?

If this is not the way to get this to work, what do I do instead?

up vote 0 down vote accepted

If I provide the IdentityFile for the production-eb:* config, it looks for it on my own machine. How do I get it to use this key on the gateway machine?

You should have the keys on your local machine, which is trusted place to store private keys. I would not consider gateway machine as trusted if you don't have it under your table.

This is expected behaviour, since the gateway is just jumpbox and the only thing that runs on that machine is the netcat command, as you can see. There is a way to workaround it though. I believe you can use forwarding without proxy command:

ssh -tt production ssh -tti path/to.key $(~/bin/instancefinder %h | tail -n1)
  • That still seems to be looking for the key on my machine. EDIT: this seems to work, but gets stuck. Updated question. – zsquare Oct 28 '15 at 10:35
  • Yes. I see now it doesn't make sense. Proxy command works different way. But running the command directly as in edited question should make it work. It is not elegant like proxy command, but you can store it as bash alias. – Jakuje Oct 28 '15 at 10:50
  • Yup, that finally worked. Thanks! – zsquare Oct 28 '15 at 10:57

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.