So I have a weird ssh problem with agent fowarding I'm trying to debug. I have a number of machines inside a firewall I can access via proxy, or directly if I'm connected inside the firewall. Everything works fine except for one case -- one machine if I connect to it via the proxy and then try to do anything with the ssh-agent (forwarded via the ssh agent forwarding), it locks up -- the connection hangs and eventually times out, disconnecting the ssh session. As long as I don't do anything that tries to access the agent it works fine. But even an ssh-add -l
locks up.
This only happens with one host, and only when connecting via the proxy. Other hosts via the proxy or this host directly (when inside the firewall) all work fine.
So my question is, how do I go about debugging this? I've tried using ssh -v
when connecting to get some info about what is going on. When I use that in a working case, I see something like:
$ ssh-add -l
debug1: client_input_channel_open: ctype [email protected] rchan 2 win 65536 max 16384
debug1: channel 1: new [authentication agent connection]
debug1: confirm [email protected]
debug1: channel 1: FORCE input drain
...key fingerprints from the agent.
But in the non-working case I just get
$ ssh-add -l
debug1: client_input_channel_open: ctype [email protected] rchan 2 win 65536 max 16384
debug1: channel 1: new [authentication agent connection]
debug1: confirm [email protected]
and then it hangs (and times out after a couple of minutes, disconnecting the entire ssh session.)
All hosts in question are running OpenSSH_7.2p2 Ubuntu-4ubuntu2.8, OpenSSL 1.0.2g 1 Mar 2016
I'm doing the proxying with
ProxyCommand /bin/nc -x proxy_host:1080 %h %p
and the agent forwarding with
ForwardAgent yes
in my .ssh/config file. I've stripped this down as much as possible (so removed everything else from the config file, with no change in behavior).
On the target machine, the agent socket looks normal:
--> echo $SSH_AUTH_SOCK
/tmp/ssh-WMT414Uq0q/agent.2170
--> ls -l $SSH_AUTH_SOCK
srwxrwxr-x 1 cdodd cdodd 0 Apr 2 09:06 /tmp/ssh-TTx7SEvwkx/agent.2170=
/etc/ssh/sshd_config
, which I could imagine might lead to oddities. Check that config file and see what it says.ssh -v host
to connect to the host -- using the notedProxyCommand
in my .ssh/config file to do the proxying.