I'd recommend using of ssh agent - that way you only need one key pair where your private part is kept on your workstation. No need to replicate it on other servers (which is bad idea as such) or create other key pairs for specific servers.
There are more that one way to start ssh agent, you can read more on it there. Here is the simplest one:
then you add your key(s) to the agent
This asks you for pass phrase if your key is protected. Once added you can connect to the servers having the public part without prompting.
What is more, you can continue ssh'ing from that server to another and the agent will carry your authentication further as long as AllowAgentForwarding option of ssh servers on your way is set to yes, which is mostly default setting.
Well, that was a preface :)
Now back to your case. Unless port forwarding is prohibited by server config, the approach is following:
- Check you can connect to SERVER2 using agent -
ssh ubuntu@SERVER1 'echo Hi from $(hostname)'
- Check your agent forwarding works from SERVER1 to SERVER2
ssh -t ubuntu@SERVER1 ssh SERVER2 'Hi from $(hostname)'
- Start a connection with port forwarding only
ssh -R localhost:50000:SERVER2:22 -Nv
and leave this terminal window open so far.
- In a new terminal window, log on to SERVER1 and from there check the port is forwarded as requested:
[SERVER1]ssh -p 50000 localhost 'echo Hi from $(hostname)'
you should see Hi from SERVER2
If all 4 steps above work for you, then you'll be able to perform your rsync command - just omit