7

I'm currently trying to scp a file from one server to another, using an ssh key on my local computer.

this is the command I'm currently using: 

sudo scp -r -o "ForwardAgent yes" <new_folder> <second-server-path>

and I've followed this github doc to verify that my ssh agent is being forwarded to the second server's terminal.

-o "ForwardAgent yes" comes from this reference, but does not appear on my man scp reference.

However, after all this, the command still asks for a password (which we are trying to avoid). Any ideas on how to use the ssh forwarding?

Improve this question
3
  • can you access via ssh to the second server without password ?
    – Wissam Roujoulah
    Commented Nov 30, 2016 at 14:12
  • I can access the terminal of both servers from my own computer without a password. However, I am running into these issues between copying a file from one server to another @WissamAl-Roujoulah
    – efong5
    Commented Nov 30, 2016 at 14:39
  • check the user that you are trying to use on the remote server and make sure that is the same use that you added a ssh key for it when you copy the file
    – Wissam Roujoulah
    Commented Nov 30, 2016 at 14:41

2 Answers 2

Reset to default
6

  • scp does not support to forward your agent (hardcoded to be disabled in the code) so this is not possible what you are trying.

  • The problem is in sudo. Connection to ssh-agent is stored in environment variable SSH_AUTH_SOCK (echo $SSH_AUTH_SOCK) and this variable is not preserved during the sudo so there are two possibilities:

    • Do not use sudo to scp. Run just scp to some sane location and then sudo cp the file to the desired location.

    • Force sudo to preserve env. variables using the -E switch:

      sudo scp -r <new_folder> <second-server-path>

  • When you want to copy the file between two servers, use -3 switch, which will make both authentications from your host, where you have access to your agent.

Improve this answer
3
  • 1
    "When you want to copy the file between two servers, use -3 switch, which will make both authentications from your host, where you have access to your agent." according to the man page, there is no -3 option. Only 1,2,4 or 6.
    – Sacha Vorbeck
    Commented Sep 5, 2018 at 7:56
  • @SachaVorbeck It probably means that you have very old OpenSSH version. Try to update.
    – Jakuje
    Commented Sep 5, 2018 at 18:10
  • -3 Copies between two remote hosts are transferred through the local host. Without this option the data is copied directly between the two remote hosts. Note that this option disables the progress meter. It's not properly what @efong5 is trying to achieve but..
    – sgargel
    Commented Apr 30, 2020 at 6:40
4

With OpenSSH 8.4 (released 2020-09-27) support for agent forwarding was added to scp and sftp.

https://www.openssh.com/txt/release-8.4

  • scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it.

Warning! Using agent forwarding is a security issue, when the jump host is compromised or when you are affected from a mitm attack.

If you are using a jump host to copy files from your local machine to an internal network, it is better to use ProxyJump instead of agent forwarding, because the connection to the destination server is end to end encrypted and the jump host can not access your agent or read the data.

Example scp command using a jump host:

scp -o 'ProxyJump your.jump.host' myfile.txt remote.internal.host:/my/dir

Update:

Agent forwarding for scp and sftp was added to OpenSSH 8.4 for remote to remote file transfers.

In the past you had to provide credentials on the first host or you had to route the traffic through your local machine.

Now with OpenSSH 8.4 scp and sftp are capable of agent forwarding.

scp -A user1@remote1:/home/user1/file1.txt user2@remote2:/home/user2/file1.txt
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .