4

I'm looking to ssh from my localhost to a remote server, and from there to a remote computer. I currently have it set up so that the remote computer and remote server have passwordless ssh-ing set up between them, but if I ssh from my localhost into the server, and then try to ssh to the computer from there, I get:

Enter passphrase for key '/home/user/.ssh/id_dsa': 
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive).

If I try to ssh from a terminal open on the remote server to the remote computer, it works just fine. Does it have something to do with my display not being :0.0, or something else entirely? I've tried xhost +local: but been lost past that.

Thanks

Improve this question

2 Answers 2

Reset to default
3

If both systems have the public key of your local system use -A.

From ssh(1)

-A      Enables forwarding of the authentication agent connection.  This
        can also be specified on a per-host basis in a configuration file.

Also be aware of this warning:

        Agent forwarding should be enabled with caution.  Users with the
        ability to bypass file permissions on the remote host (for the
        agent's UNIX-domain socket) can access the local agent through the
        forwarded connection.  An attacker cannot obtain key material from
        the agent, however they can perform operations on the keys that
        enable them to authenticate using the identities loaded into the
        agent.

The result is that when you auth against the second host the auth is forwarded all the way back to the host where you physically reside.

Example:

me@host0:~ $ ssh -A host1
Last login: Thu Jun 14 11:31:53 2012 from 2001:db8::b0
me@host1:~ $ ssh -A host2
Last login: Thu Jun 14 11:41:05 2012 from 2001:db8::b1
me@host3:~ $ ssh -A host3
Last login: Tue Jun 12 10:46:50 2012 from 2001:db8::b2
me@host3:~ $
Improve this answer
4
  • So in the event I want to make this extensible and have five or six computers log in to the server (with one username), and then have passwordless access to the remote computer, I'd have to add all of their public keys to both server and remote computer?
    – vityav
    Jun 14, 2012 at 21:54
  • 1
    No. Add the public key for only the computer you are physically using to all remote systems.
    – bahamat
    Jun 14, 2012 at 21:56
  • I meant if I wanted my laptop, work computer, and tablet to all log into a central server, and from there have passwordless access to another computer, I'd have to pass around all three public keys, which I was hoping to avoid, but should work. Thanks
    – vityav
    Jun 15, 2012 at 2:01
  • Yes, true. Or you can use the same secret key on each (although not recommended). I use cfengine to distribute my public key to all hosts.
    – bahamat
    Jun 15, 2012 at 18:12
1

Your agent is unable to pass authentication on to the remote computer. You can port-forward a connection to connect directly to the remote machine if you would like.

See this article on SSH multi-hop and skip to the section about ProxyCommand

in ~/.ssh/config:

Host remotecomputername
  ProxyCommand ssh -q remoteservername nc -q0 remotecomputername 22
Improve this answer
2
  • Though very cool to know, it's still giving me a Permission Denied error. I've also tried adding the flags -t and -ax to no avail, and copying the id_dsa files to my localhost didn't help either.
    – vityav
    Jun 14, 2012 at 18:01
  • Though the private key unlocks automatically for terminals on the remote server, it doesn't seem to transfer that to my remote login. Is it even possible to do that?
    – vityav
    Jun 14, 2012 at 18:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .