How to copy with SCP between two servers using key auth?

Question

I can log in via SSH using key authentication to SERVER1 and SERVER2. However, I can't copy files between the two servers. Why? How can I copy between them? (the data that I have to copy is bigger than my notebooks HDD)

My notebook runs Ubuntu 10.04 LTS and the two servers are AIX 5300-10-02-0943. My ~/.ssh/known_hosts file on my notebook contains the public keys for these two servers. I use tsocks because I have to use an SSH tunnel to reach these two servers. The two servers can ping each other.

[USER@NOTEBOOK ~] tsocks scp -v -i /home/USER/.ssh/id_rsa -p -r root@SERVER1:/PATH/TO/DIR root@SERVER2:/PATH/TO/DIR
Executing: /usr/bin/ssh '-v' '-x' '-oClearAllForwardings yes' '-n' '-l' 'root' 'SERVER1' 'scp -v -r -p' '/PATH/TO/DIR' 'root@SERVER2:/PATH/TO/DIR'
OpenSSH_5.3p1 Debian-3ubuntu7, OpenSSL 0.9.8k 25 Mar 2009
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to SERVER1 [SERVER1] port 22.
debug1: Connection established.
debug1: identity file /home/USER/.ssh/identity type -1
debug1: identity file /home/USER/.ssh/id_rsa type 1
debug1: Checking blacklist file /usr/share/ssh/blacklist.RSA-1024
debug1: Checking blacklist file /etc/ssh/blacklist.RSA-1024
debug1: identity file /home/USER/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2p1+sas
debug1: match: OpenSSH_5.2p1+sas pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'SERVER1' is known and matches the RSA host key.
debug1: Found key in /home/USER/.ssh/known_hosts:59
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering public key: /home/USER/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 151
debug1: Authentication succeeded (publickey).
debug1: channel 0: new [client-session]
debug1: Requesting [email protected]
debug1: Entering interactive session.
debug1: Sending environment.
debug1: Sending env LANG = en_US.utf8
debug1: Sending command: scp -v -r -p /PATH/TO/DIR root@SERVER2:/PATH/TO/DIR
Executing: program /applications/ssh/5.20.15.0/bin/ssh host SERVER2, user root, command scp -v -r -p -t /PATH/TO/DIR
OpenSSH_5.2p1+sas, OpenSSL 0.9.8k 25 Mar 2009
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to SERVER2 [SERVER2] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/identity type -1
debug1: identity file /root/.ssh/id_rsa type -1
debug1: identity file /root/.ssh/id_dsa type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.2p1+sas
debug1: match: OpenSSH_5.2p1+sas pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.2
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: read_passphrase: can't open /dev/tty: No such device or address
Host key verification failed.
lost connection
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 1984, received 3848 bytes, in 0.3 seconds
Bytes per second: sent 6903.4, received 13389.2
debug1: Exit status 1


[USER@NOTEBOOK ~] tsocks scp -i /home/USER/.ssh/id_rsa -p -r root@SERVER1:/PATH/TO/DIR root@SERVER2:/PATH/TO/DIR
Host key verification failed.
lost connection
[USER@NOTEBOOK ~]

does /dev/tty exist? try this: ben.goodacre.name/tech/Can't_open_/dev/… — vjeffz, Jun 7, 2012 at 1:09

2 revs, 2 users 98% · Accepted Answer · 2014-10-28 08:46:05Z

This is very easy to fix. See, the source server does not know the destination server and it can't ask you to confirm the identity, since you don't have a terminal open there:

debug1: read_passphrase: can't open /dev/tty: No such device or address
Host key verification failed.
lost connection

So just log in to the source account/server and try to ssh (or scp) to the dest account, accept the host key and cancel login/scp. You should be able to copy.

local $ ssh source@src-server
src-server $ ssh dest@dst-server
The authenticity of host 'destination (10.0.0.x)' can't be established.
RSA key fingerprint is 71:ec:c0:86:7f:b6:51:eb:76:c8:1f:2f:ba:0a:f4:20.
Are you sure you want to continue connecting (yes/no)? yes
dest@dst-server's password: ^C
src-server $ exit

local $ scp -r source@src-server:/path/to/files dest@dst-server:/path/to/files

If not, try:

local $ scp -r -o "ForwardAgent=yes" source@src-server:/path/to/files dest@dst-server:/path/to/files

If you have a SSH key with access to the destination server and the source server does not, adding -o "ForwardAgent=yes" will allow you to forward your SSH agent to the source server so that it can use your SSH key to connect to the destination server.

sr_ · Accepted Answer · 2012-05-04 08:41:42Z

6

A little diagnosis: from this

debug1: Sending command: scp -v -r -p /PATH/TO/DIR root@SERVER2:/PATH/TO/DIR
[...]
debug1: read_passphrase: can't open /dev/tty: No such device or address

I'd suspect (guess) it works this way, the server-to-server copy with scp logs into SERVER1 and executes the scp command to send the file to SERVER2; thus the caller (from SERVER1) has to authenticate itself. Now this fails since it's non-interactive (there's no /dev/tty) and there's no way to ask for a passphrase.

This means copying the key to SERVER1 (I can't tell if this is possible in your situation) could probably fix the issue (I think...) (If there is no passphrase...which is rather bad)

Edit A solution could be the following, use sshfs to access the files you want to send, send them via scp from the sshfs-mounted directory. This should get you the needed interactivity (if the guess above was right) and keep all keys local.

edited May 4, 2012 at 8:41

answered May 4, 2012 at 8:35

sr_

15.3k51 silver badges56 bronze badges

sshfs is not an option.
– LanceBaynes
May 4, 2012 at 8:58
So the problem is that SERVER1 can't ssh to SERVER2 with key auth? Are there any ssh client parameters for this to use the key on my notebook?
– LanceBaynes
May 4, 2012 at 8:59
2

No idea, I'm afraid. You could, however, use ssh SERVER1 scp *args-YOU-specifiy* for a little more flexibility. Maybe some stdin trickery could help... I'm not sure.
– sr_
May 4, 2012 at 9:35
2

@utopiabound's answer (using ssh-agent) sounds a lot better than stdin trickery.
– sr_
May 4, 2012 at 11:05

Add a comment |

utopiabound · Accepted Answer · 2012-05-04 10:13:25Z

3

I've tried this and it works for me between two systems, a few differences:

I have an SSH agent running with my SSH key added (ssh-add)
I have ssh-agent forwarding enabled by default

Try the following:

ssh-add
scp -v -o "ForwardAgent=yes" -p -r root@SERVER1:/PATH/TO/DIR root@SERVER2:/PATH/TO/DIR

answered May 4, 2012 at 10:13

utopiabound

3,27421 silver badges19 bronze badges

still "Host key verification failed."
– LanceBaynes
May 4, 2012 at 10:17
@LanceBaynes Ensure that you've logged into SERVER2 from SERVER1 as root. Maybe you don't have it in root's known hosts file on SERVER1?
– utopiabound
May 4, 2012 at 16:12

Add a comment |

törzsmókus · Accepted Answer · 2017-01-04 12:32:25Z

3

you might want to use the -3 option of scp, it directs the traffic through your notebook.

i.e. [USER@NOTEBOOK ~] scp -3 root@SERVER1:/PATH/TO/DIR root@SERVER2:/PATH/TO/DIR

answered Jan 4, 2017 at 12:32

törzsmókus

1841 silver badge9 bronze badges

Add a comment |

Gustavo · Accepted Answer · 2014-08-06 15:09:25Z

Try this options for ssh:

-o StrictHostKeyChecking=no
-o UserKnownHostsFile=.ssh/known_hosts [OPTIONAL]

In my case, i trying to connect with ssh from inside SP in postgreSQL. First attemp failed:

pc_ubuntu_db=# SELECT command('ssh -q -v [email protected] hostname');
debug1: Server host key: RSA 0a:28:83:72:d7:7d:89:93:96:a1:1b:e2:f9:22:85:62 
debug1: read_passphrase: can't open /dev/tty: No such device or address
        Host key verification failed.

The source of problem: can't write in know_host

pc_ubuntu_db=# SELECT command('ssh -v -o StrictHostKeyChecking=no -i [email protected] hostname');
debug1: Server host key: RSA 0a:28:83:72:d7:7d:89:93:96:a1:1b:e2:f9:22:85:62
Warning: Permanently added '10.30.134.26' (RSA) to the list of known hosts.
debug1: ssh_rsa_verify: signature correct
...
Transferred: sent 2672, received 2040 bytes, in 0.0 seconds
Bytes per second: sent 214358.6, received 163657.0
debug1: Exit status 0

Next connection output:

debug1: Server host key: RSA 0a:28:83:72:d7:7d:89:93:96:a1:1b:e2:f9:22:85:62
debug1: Host '10.30.134.26' is known and matches the RSA host key.
debug1: Found key in /var/lib/postgresql/.ssh/known_hosts:3
debug1: ssh_rsa_verify: signature correct

success !!!

Stack Exchange Network

How to copy with SCP between two servers using key auth?

5 Answers 5

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
ssh
scp
.

Hot Network Questions

How to copy with SCP between two servers using key auth?

5 Answers 5

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged sshscp.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
ssh
scp
.