Run remote command while adding key to agent, to avoid passphrase prompt interfering with the script

Question

How can I run a command at remote Host2 via remote Host1, while adding my key to the ssh-agent, so that the passphrase prompt does not interfere with the latter part of the script?

I am basically trying to run a command at remote Host2 via remote Host1, without the passphrase prompt interfering. (The local machine cannot ssh into remote Host2 directly). [SSH has been setup to use key authentication.]

Although the end result is ultimately to pipe a file, I imagine a more general description is still relevant.

If I simply nest the commands like so:

ssh -t Host1 "ssh Host2 "cat remotefile.mp4""

I am prompted for the passphrase of Host1 since the key is not present in the agent there.

If I wish to pipe the output of that command from Host2 to another process in the local machine, the passphrase prompt also gets piped or redirected as it is in the way.

I thus consider doing the following, to get Hosts1's key into the agent before running the relevant command:

ssh -t Host1 "`eval ssh-agent -s`; ssh-add ~/.ssh/host1-id_key; ssh-add -l; ssh Host2 "cat remotefile.mp4""

However I am having trouble with the proper syntax chaining/nesting the above mentioned commands in bash.

I get:

syntax error near unexpected token `;;'

I believe it has to do with the backticks command substitution syntax, and I admit I don't completely understand its implications.

I have tried the following variations but with the same failed results:

ssh -t Host1 "`eval ssh-agent -s` && ssh-add ~/.ssh/host1-id_key && ssh-add -l; ssh Host2 "cat remotefile.mp4""

ssh -t Host1 << HERE
`eval ssh-agent -s`;
ssh-add ~/.ssh/host1-id_key;
ssh-add -l;
ssh Host2 "cat remotefile.mp4"
HERE

How do I successfully chain/nest several commands to be executed by the remote shells, in particular the eval ssh-agent one.

Answer 1

You can enable agent forwarding with -A. This will allow you to connect to your local ssh-agent from the remote host.

ssh -A Host1 ssh Host2 cat remotefile.mp4

If you always want to forward your agent to Host1, you can add the following to your ~/.ssh/config, and then you don't have to specify -A.

Host Host1
    ForwardAgent yes

Be aware of the security implications of agent forwarding. From the ssh(1) man page:

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent. A safer alternative may be to use a jump host (see -J).

As noted in the man page, an alternative is to use the jump host (-J) option. This is a little less flexible, but works fine if all you do on the first host is ssh to the second. To use this, we'd modify your example command as follows:

ssh -J Host1 Host2 cat remotefile.mp4

Here -J Host1 instructs ssh to connect to the remote host (Host2) via TCP forwarding on Host1.

If you always want to connect to Host2 using Host1 as a jump host, you can configure this in your ~/.ssh/config:

Host Host2
    ProxyJump Host1

Then you would only need to run ssh Host2 cat remotefile.mp4, and ssh would automatically tunnel this connection via Host1.