ssh password-less login doesn't work using proxycommand

Question

I have 2 servers. I can connect to server B only using server A. In my ~/.ssh/config file:

Host serverB
  Hostname serverb
  User root
  ForwardAgent yes
  Port 22
  ProxyCommand ssh user@serverA nc %h %p

When I login to serverA and type ssh root@serverB It connects without asking for password, but when I type ssh ServerB on my local machine, it asks for ServerB's password. Why?

Answer 1

ProxyCommand gives just a tunnel to pipe the outer ssh connection through.

When you do ssh serverB from serverA, you're probably using a key on your account on serverA.

When you do ssh serverB from your client machine, the fact that you're connecting via that nc command started on serverA is not going to magically give you access to the keys on serverA.

You'll need to add serverA's keys to your client agent.

For instance:

ssh-add <(ssh serverA 'cat .ssh/id_rsa')

To add the key in .ssh/id_rsa on serverA (ksh93/bash/zsh syntax above).

Answer 2

Few things:

1. How sure are you its asking for serverB's password ? It might be asking for serverA's
2. You don't need to forward your agent - you will be handshaking directly with serverB in this case - it wont be serverA that is handshaking with serverB
3. You don't need to add key from serverA to your client - again you will be talking directly to serverB - just through serverA - so cant see point in doing this - and its also a security hazard.
4. What happens when you ssh serverA - does it ask for a password ? if it does - have you considered installing your public key on serverA's authorized_hosts ? ssh-copy-id serverA ?
5. run with -vvv and pastebin/filebin/post output

Answer 3

I do not have a full answer, just some things to check. Verify the permissions of the home directories of the unix user on both boxes. Verify the directory permissions to $HOME, to $HOME/.ssh, and all the files under .ssh in both boxes. Check the versions of ssh. Compare the ssh config files for both boxes also.

But this has happened to me many times in the past. The two things that have caused it?
1. incorrect permissions in directories. 2. A bad server key in $HOME/.ssh/