4

I have 2 servers. I can connect to server B only using server A. In my ~/.ssh/config file:

Host serverB
  Hostname serverb
  User root
  ForwardAgent yes
  Port 22
  ProxyCommand ssh user@serverA nc %h %p

When I login to serverA and type ssh root@serverB It connects without asking for password, but when I type ssh ServerB on my local machine, it asks for ServerB's password. Why?

|improve this question
2

ProxyCommand gives just a tunnel to pipe the outer ssh connection through.

When you do ssh serverB from serverA, you're probably using a key on your account on serverA.

When you do ssh serverB from your client machine, the fact that you're connecting via that nc command started on serverA is not going to magically give you access to the keys on serverA.

You'll need to add serverA's keys to your client agent.

For instance:

ssh-add <(ssh serverA 'cat .ssh/id_rsa')

To add the key in .ssh/id_rsa on serverA (ksh93/bash/zsh syntax above).

|improve this answer
  • 1
    Not that this would not work, but if you do this then you have to give an intermediate hop access to your endpoint. i.e. now ServerA can get to ServerB without knowing ServerB's password - where you really just want Client to be able to access ServerB without password. – Iwan Aucamp Oct 2 '14 at 9:52
2

Few things:

  1. How sure are you its asking for serverB's password ? It might be asking for serverA's
  2. You don't need to forward your agent - you will be handshaking directly with serverB in this case - it wont be serverA that is handshaking with serverB
  3. You don't need to add key from serverA to your client - again you will be talking directly to serverB - just through serverA - so cant see point in doing this - and its also a security hazard.
  4. What happens when you ssh serverA - does it ask for a password ? if it does - have you considered installing your public key on serverA's authorized_hosts ? ssh-copy-id serverA ?
  5. run with -vvv and pastebin/filebin/post output
|improve this answer
  • regarding point 1, how can you tell? In my case, it keeps asking for a password (both A and B have my public key in their authorized hosts file) yet neither password for A nor B are accepted (no error in ssh -vvv, it just says interactive passwords are allowed and it asks for the password again!) – Michael Apr 23 '17 at 22:03
1

I do not have a full answer, just some things to check. Verify the permissions of the home directories of the unix user on both boxes. Verify the directory permissions to $HOME, to $HOME/.ssh, and all the files under .ssh in both boxes. Check the versions of ssh. Compare the ssh config files for both boxes also.

But this has happened to me many times in the past. The two things that have caused it?
1. incorrect permissions in directories. 2. A bad server key in $HOME/.ssh/

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.