1

I have a very big amount of machines that are accessible only from the intermediate host. I can share my ssh-keys with the intermediate host, but there is no sense to preliminary share the keys with target hosts since each day I connect to different hosts and very very rare to the same host on the second day.

Is it possible to forward my password or keys to target hosts (one for many machines) when I'm connecting to them through the intermediate host? The solution I'm looking for now is to not entering the password each time when logging into the target machine.

  • ssh allows signed keypairs, but instead of your public key, you'd need to provision the servers with a signing authority certificate. That would probably only start to be useful if you have more than one person with that problem for your set of servers. – Ulrich Schwarz May 6 '17 at 6:22
  • @UlrichSchwarz "signed keypairs" means that some preliminary work (adding public key) is mandatory if I want to log in without entering the password each time? – Vitalii Plagov May 6 '17 at 9:11
  • Yes. You need some way to establish that the server should trust you/your key, but not anybody else, and that will require some sort of server-side configuration. – Ulrich Schwarz May 6 '17 at 11:38
1

All the solutions require some preliminary setup (because by default, there is no trust between independent systems -- if it would be, it would be serious security issue).

You can add your public key to the process of provisioning/installing new servers, you can add a CA keys to be trusted as pointed by @UlrichSchwarz or you can join them in Kerberos domain and authenticate using kerberos tickets.

There is a lot of possibilities, but nothing will work for you out of the box.

As I read through your question for the third time I am no longer sure I understand your question correctly. You might be just searching for ssh-agent forwarding? If not, please clarify.

  • Thank you for the answer. If I understand correct the ssh-agent is useful after the first login to the server. But I'm looking for a solution to login to the server from the first time without manually typing the password. So far I'm doing it with the help of expect script. But I was thinking that maybe ssh native functionality allows it – Vitalii Plagov May 6 '17 at 23:07
  • No. The OpenSSH does not implement storing passwords in configuration files. You might have a look at the sshpass, which will do basically the same or some kind of automation (ansible). – Jakuje May 7 '17 at 6:00
  • 1
    Looks like sshpass might be a solution here. I'll try to use it with ProxyCommand in ssh config. Thank you! – Vitalii Plagov May 7 '17 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.