0

I have my local machine (a mac), and I want to access server B (linux). Server B needs to be accessed through server A (linux). I have set up a tunnel by modifying the .ssh/config file in my local machine as follows:

Host serverB
 HostName serverB.com
 User Ant
 ProxyCommand ssh -q -Y serverA.com -W %h:%p

This used to work correctly[0]. Next, I set up passwordless login from local to serverA and from serverA to serverB using ssh keys. This means that I can do

> ssh Ant@serverA.com
(serverA)> ssh Ant@serverB.com
(serverB)>

and everything works properly. Now what I want is to be able to connect to server B without passwords; but if I do

> ssh Ant@severB.com

I am asked the passwords to severA and B to keep going. This is the output of ssh -v Ant@serverB:

OpenSSH_7.6p1, LibreSSL 2.6.2
debug1: Reading configuration data /Users/Ant/.ssh/config
debug1: /Users/Ant/.ssh/config line 16: Applying options for serverB
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug1: Executing proxy command: exec ssh -q -Y serverA.com -W serverB.com:22
debug1: identity file /Users/Ant/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Ant/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Ant/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Ant/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Ant/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Ant/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Ant/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/Ant/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6
debug1: permanently_drop_suid: 501
Ant@serverA.com's password: 

I can see that it is trying to use the key login but something is going wrong. Let me also add that my RSA key is saved into a non-standard location, so I added this to my .ssh/config file:

IdentityFile ~/.ssh/key_serverA

Any thoughts?

[0]: For some reason this does not work anymore, as the username is wrong. It prompts me for my password at local_username@serverA.com rather than Ant@serverA.com

EDIT

I found a solution. The problem was that, for some reason, ssh tried to access serverA using local_username rather than Ant (the username on serverA and serverB). To solve the issue I modified the config tunnel command by explicitly adding my username:

Host serverB
 HostName serverB.com
 User Ant
 ProxyCommand ssh -q -Y Ant@serverA.com -W %h:%p

This fixed the issue and now passwordless login works with serverB too! :-)

  • IIRC, you need to setup passwordless login for both serverA and serverB on the local machine to be able to tunnel to serverB through serverA. – Mioriin Feb 6 '18 at 9:06
  • 1
    The User option in a Host section is only applied for that connection, not for any commands started for proxying, etc. So either the proxycommand should explicitly have Ant@serverA, or there should be another Host block for serverA setting User Ant. – muru Feb 6 '18 at 9:20
  • @muru Thanks for clarifying! I literally just edited the question to include the solution that I found (more or less randomly). If you make that an answer I will accept it! :) – Ant Feb 6 '18 at 9:22
2

The User option in a Host section is only applied for connections matching that host, and not necessarily for any commands started for proxying, etc., for which ssh config settings will be independently applied.

So either the ProxyCommand should explicitly have Ant@serverA, or there should be another Host block that serverA matches, setting User Ant for it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.