I work in an environment where I have multiple ssh keys for multiple environments, all of which utilize a bastion host, meaning to ssh to any box in any environment, it is a 2-step hop, first to the bastion, and the second to the target box, and my ssh identity has to be carried with me the whole way.
I know that both ssh and .ssh/config have options to forward all of your current ssh identities with you to the bastion host, such that you can re-use them there:
ssh -A IPADDRESS and
Additionally, I know that .ssh/config has the
IdentityFile option which allows me to specify which ssh key is used depending on the host that I am trying to connect to. However, what I have noticed is that any identities used by the IdentityFile option are not forwarded by the
ForwardAgent - I make it to the bastion host, but without my key and I cannot ssh to the next box.
The only way I have been able to accomplish this so far is to manually add the identity that I need to use with
ssh-add ~/.ssh/id_rsa[1-10], and then to ssh using either
ssh -A. However, this can be a pain when I have many identities that I need to switch between.
Is there a way I can accomplish all of this using just the ssh config file??