1

The design: multiple network security zones, some with Linux servers only, some with Windows only.

Objective: Secure Copy (scp) between two Linux servers using a Win10 OpenSSH as proxy

linux1 (zone A) > Win10-1 (zone B) > linux2 (zone C)

[Updated: some progress] Authentication is SSH key based. I ran ssh-keygen on linux1and copied the .pub file to Win10-1, then copied the content into C:\Users\[username]\.ssh\authorized_keys and this works as intended: I can ssh from linux1 into the Win10-1passwordless. The same procedure should work when running ssh-keygen on Win10-1; I have my key pair and copy the pub file to linux2 but logging in from Win10-1to linux2 using ssh user@linux2 fails and the Powershell prompt hangs - but if I do Start ssh user@linux2, then it works.

To test the intended connection, I did:

#linux1: ssh -J username@proxy-win10 username@target-linux2

And it gets me through just fine - but only after prompting for the login password on linux2.

I suspect that the final hurdle is that required Start ssh user@linux2 - is the OpenSSH server instance maybe broken?

3
  • Were you prompted for password for the private key or for the login password?
    – DannyNiu
    Jan 29, 2020 at 9:47
  • @DannyNiu login pw
    – DavDav
    Jan 29, 2020 at 9:49
  • Are you able to go on Win10 machine and run ssh -vvv username@target-linux2 ?
    – Philippe
    Jan 31, 2020 at 13:06

1 Answer 1

0

This is actually mostly a security question.

Point 1

The only way an SSH proxy can be useful is when the target host stays behind public network, such as the following:

                                     +--- Office Computer 1
Internet <--- Router-NAT-Firewall <--+--- Office Computer 2
                                     +--- Linux Server (no port forwarding)
                                     +=== Windows Server (with SSH port forwarding)

Otherwise, your Windows server is just an actor playing in a security theater.

Point 2

SSH is a very useful transport protocol for applications, you should maximize its security by mandating users use public-key cryptography to authenticate themselves.

In "sshd_config":

  • Use the "AllowUsers" directive to select the users allowed to login from SSH.

  • Use the "Match" directive on the selected users and use "AuthenticationMethods" directive to restrict them from logging in with passwords.

2
  • No problem security-wise - and that was not my question. The design is what it is; what I have to deal with is getting the key authentication to work. Any suggestions?
    – DavDav
    Jan 29, 2020 at 10:13
  • That'd be my point 2 in the answer - configure the server to deny less-secure user-authentication methods.
    – DannyNiu
    Jan 29, 2020 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .