1

The design: multiple network security zones, some with Linux servers only, some with Windows only.

Objective: Secure Copy (scp) between two Linux servers using a Win10 OpenSSH as proxy

linux1 (zone A) > Win10-1 (zone B) > linux2 (zone C)

[Updated: some progress] Authentication is SSH key based. I ran ssh-keygen on linux1and copied the .pub file to Win10-1, then copied the content into C:\Users\[username]\.ssh\authorized_keys and this works as intended: I can ssh from linux1 into the Win10-1passwordless. The same procedure should work when running ssh-keygen on Win10-1; I have my key pair and copy the pub file to linux2 but logging in from Win10-1to linux2 using ssh user@linux2 fails and the Powershell prompt hangs - but if I do Start ssh user@linux2, then it works.

To test the intended connection, I did:

#linux1: ssh -J username@proxy-win10 username@target-linux2

And it gets me through just fine - but only after prompting for the login password on linux2.

I suspect that the final hurdle is that required Start ssh user@linux2 - is the OpenSSH server instance maybe broken?

3
  • Were you prompted for password for the private key or for the login password? – DannyNiu Jan 29 '20 at 9:47
  • @DannyNiu login pw – DavDav Jan 29 '20 at 9:49
  • Are you able to go on Win10 machine and run ssh -vvv username@target-linux2 ? – Philippe Jan 31 '20 at 13:06
0

This is actually mostly a security question.

Point 1

The only way an SSH proxy can be useful is when the target host stays behind public network, such as the following:

                                     +--- Office Computer 1
Internet <--- Router-NAT-Firewall <--+--- Office Computer 2
                                     +--- Linux Server (no port forwarding)
                                     +=== Windows Server (with SSH port forwarding)

Otherwise, your Windows server is just an actor playing in a security theater.

Point 2

SSH is a very useful transport protocol for applications, you should maximize its security by mandating users use public-key cryptography to authenticate themselves.

In "sshd_config":

  • Use the "AllowUsers" directive to select the users allowed to login from SSH.

  • Use the "Match" directive on the selected users and use "AuthenticationMethods" directive to restrict them from logging in with passwords.

2
  • No problem security-wise - and that was not my question. The design is what it is; what I have to deal with is getting the key authentication to work. Any suggestions? – DavDav Jan 29 '20 at 10:13
  • That'd be my point 2 in the answer - configure the server to deny less-secure user-authentication methods. – DannyNiu Jan 29 '20 at 10:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.