I can ssh from hostA
to hostB
and from hostA
to hostC
using keys loaded into ssh-agent without any problems. However, if I do ssh -A hostB
from hostA
, then try ssh hostC
from hostB
, public key authentication doesn't work and it asks for my password.
Some details:
- I am using
ssh-agent
that comes with OpenSSH, not GNOME Keyring or anything like that. Both
ssh -v hostB
fromhostA
andssh -v hostC
fromhostA
show:debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/rhansen/.ssh/id_rsa debug1: Server accepts key: pkalg ssh-rsa blen 279 debug1: Authentication succeeded (publickey).
I see my key when I run
ssh-add -L
onhostB
.- My key on
hostA
is protected with a password. - On
hostB
,/etc/ssh/sshd_config
does NOT containAllowAgentForwarding no
. - All three systems run Ubuntu 15.10 (Wily) with OpenSSH 6.6.1p1.
When I run
ssh -vvv hostC
fromhostB
, the following is logged:... debug2: key: /home/rhansen/.ssh/id_rsa ((nil)), debug2: key: /home/rhansen/.ssh/id_dsa ((nil)), debug2: key: /home/rhansen/.ssh/id_ecdsa ((nil)), debug2: key: /home/rhansen/.ssh/id_ed25519 ((nil)), debug1: Authentications that can continue: publickey,password debug3: start over, passed a different list publickey,password debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password debug3: authmethod_lookup publickey debug3: remaining preferred: keyboard-interactive,password debug3: authmethod_is_enabled publickey debug1: Next authentication method: publickey debug1: Trying private key: /home/rhansen/.ssh/id_rsa debug3: no such identity: /home/rhansen/.ssh/id_rsa: No such file or directory debug1: Trying private key: /home/rhansen/.ssh/id_dsa debug3: no such identity: /home/rhansen/.ssh/id_dsa: No such file or directory debug1: Trying private key: /home/rhansen/.ssh/id_ecdsa debug3: no such identity: /home/rhansen/.ssh/id_ecdsa: No such file or directory debug1: Trying private key: /home/rhansen/.ssh/id_ed25519 debug3: no such identity: /home/rhansen/.ssh/id_ed25519: No such file or directory debug2: we did not send a packet, disable method debug3: authmethod_lookup password debug3: remaining preferred: ,password debug3: authmethod_is_enabled password debug1: Next authentication method: password
If I do
ssh -vvv hostB
fromhostA
, then dossh hostC
, the following is logged byhostA
just before thehostC
password prompt:debug1: client_input_channel_open: ctype [email protected] rchan 2 win 65536 max 16384 debug2: fd 10 setting O_NONBLOCK debug3: fd 10 is O_NONBLOCK debug1: channel 2: new [authentication agent connection] debug1: confirm [email protected]
My
~/.ssh/config
on all systems contains the following uncommon settings (plus some common ones that I don't think are relevant):ControlMaster auto ProxyCommand sh ~/.ssh/proxy.sh '%h' '%p' '%r' IdentitiesOnly yes
Any ideas?
ssh -vv hostC
from hostA to confirm that it's really the agent that provides the keys in the working direct connection?