Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set a ssh session over a double hop with different users on each hop to transfer files easily via fish/sftp.

my .ssh/config look like

Host middle_server
    User            foo
    Hostname        192.168.xx.xx

Host target
    User            bar 
    ProxyCommand    ssh middle_server nc %h %p 2> /dev/null

The connection to middle server is secure by rsa key, and direct from the middle server to the target with the bar user.

When I try to connect to the target, I got the following error:

[foo@localhost]$ ssh target
Enter passphrase for key '/home/foo/.ssh/id_rsa':
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

I can connect with the 2 following methods, so I guess the bar user is not used for the second hop, but I have no idea of what can be the cause.

[foo@localhost]$ ssh middle_server
Enter passphrase for key '/home/foo/.ssh/id_rsa':
[foo@middle_server ~]$ ssh
[bar@www ~]$ 


[foo@localhost]$ ssh -A -t foo@middle_server ssh -A
Enter passphrase for key '/home/foo/.ssh/id_rsa':
[bar@www ~]$

Any help will be greatly appreciated, thanks in advance!

share|improve this question
Can you try ForwardAgent yes for both? – grawity Apr 20 '12 at 11:28
I added ForwardAgent yes for both both hosts, but still get the same error. – Eric Apr 20 '12 at 11:34

When you use ProxyCommand your local machine does the connection to target host. As you want to create the connection from middle to target, you should not use it (or should not use it with nc).

I would not use ForwardAgent since it is not totally secure (the user root on middle machine can encode data using your key using ssh-agent on your local machine).

So, one possible solution is to run ssh command in middle machine to target machine inside your ProxyCommand on local machine. For example:

ssh bar@doesnt_matter_host_here -o ProxyCommand='ssh foo@middle_server "ssh nc localhost 22"'

You can configure a host called "www_over_middle" with this ProxyCommand on your ~/.ssh/config:

Host www_over_middle
    User bar
    ProxyCommand ssh foo@middle_server "ssh nc localhost 22"

And then:

ssh www_over_middle
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .