Secure Copy (scp) between two Linux servers using a Win10 OpenSSH as proxy

Question

The design: multiple network security zones, some with Linux servers only, some with Windows only.

Objective: Secure Copy (scp) between two Linux servers using a Win10 OpenSSH as proxy

linux1 (zone A) > Win10-1 (zone B) > linux2 (zone C)

[Updated: some progress] Authentication is SSH key based. I ran ssh-keygen on linux1and copied the .pub file to Win10-1, then copied the content into C:\Users\[username]\.ssh\authorized_keys and this works as intended: I can ssh from linux1 into the Win10-1passwordless. The same procedure should work when running ssh-keygen on Win10-1; I have my key pair and copy the pub file to linux2 but logging in from Win10-1to linux2 using ssh user@linux2 fails and the Powershell prompt hangs - but if I do Start ssh user@linux2, then it works.

To test the intended connection, I did:

#linux1: ssh -J username@proxy-win10 username@target-linux2

And it gets me through just fine - but only after prompting for the login password on linux2.

I suspect that the final hurdle is that required Start ssh user@linux2 - is the OpenSSH server instance maybe broken?

Answer 1

This is actually mostly a security question.

Point 1

The only way an SSH proxy can be useful is when the target host stays behind public network, such as the following:

                                     +--- Office Computer 1
Internet <--- Router-NAT-Firewall <--+--- Office Computer 2
                                     +--- Linux Server (no port forwarding)
                                     +=== Windows Server (with SSH port forwarding)

Otherwise, your Windows server is just an actor playing in a security theater.

Point 2

SSH is a very useful transport protocol for applications, you should maximize its security by mandating users use public-key cryptography to authenticate themselves.

In "sshd_config":

• Use the "AllowUsers" directive to select the users allowed to login from SSH.

• Use the "Match" directive on the selected users and use "AuthenticationMethods" directive to restrict them from logging in with passwords.