0

I have set up a reverse ssh tunnel using

ssh -R 22100:127.0.0.1:22 remoteuser@remotehost

on machine 1. This machine authenticates with the remote using keys.

The remote host uses the following sshd_config options:

...
PubkeyAuthentification yes
PasswordAuthentification no
...

This works well from a third machine that has it's keys recognised by the remote server. I.e. it logs on correctly to machine 1 that set up the tunnel initially, using ssh remoteuser@remotehost -p 22100.

However, when I try to login from a forth machine that has no keys that are recognised by the remote server, I'm still being asked for a password. I.e. on the forth machine it looks like this:

ssh remoteuser@remotehost
# returns Permission denied (publickey)

ssh remoteuser@remotehost -p 22100
# is asking for password for remoteuser@remotehost

Why am I getting the password option when trying to connect to the reverse tunnel port? I don't seem to be able to use the password though. How can I disable that the password is even being asked for, if no keys are recognised?

Improve this question
2
  • 2
    What are the sshd settings in "machine 1"? The sshd settings on "remote host" only matter when you are making the connection from "machine 1" to "remotehost", and are not used when "forth machine" connects to "machine 1" via the tunnel.
    – icarus
    Commented May 1, 2020 at 13:35
  • That was it. They were the defaults, which allowed password authentication. Once I changed it, the password was not given as an option anymore... The confusing thing is that it was asking for remoteuser@remotehost password. Slightly less confusing is that I don't seem to need the key for machine 1 to access it, as long as I have the keys for remotehost. I guess machine 1 allowed the tunnel... Anyway if you make it an answer, I'll accept it @icarus
    – pandita
    Commented May 1, 2020 at 13:51

1 Answer 1

Reset to default
1

When the tunnel has been set up, any connection to port 22100 on "remotehost" is turned into a connection to port 22 of "machine 1", and in particular this applies to running ssh remoteuser@remotehost -p 22100 on "forth machine". Therefore the parameters which matter are the ones for the sshd running on port 22 of "machine 1".

The OP notes that the system is asking for a password for remoteuser@remotehost, but this is reflecting what the requested connection asked for. The ssh program doesn't know that port 22100 is being forwarded. However the host keys that are being checked are those of "machine 1" rather than "remotemachine". The known hosts database (usually ~/.ssh/known_hosts) does store the keys together with the port and host so this all works.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .