I ssh from local to X, and I would like to ssh from X to Y using password-protected RSA keys, with all my private keys being stored on local. However,

local> ssh -A X
X> ssh Y
Received disconnect: 2: Too many authentication failures

This is because I have too many keys in the agent, and it doesn't get to the right key before server Y thinks I'm malicious. I can confirm this by removing all keys from my ~/.ssh except those that are for X and Y, and then the ssh command works. Now I can't specify the correct key to use with ssh Y -o IdentiyFile=path because the right path to the key is on local, not on X. Furthermore, if I specify -o IdentitiesOnly=yes, it never looks for keys provided by the agent, it only looks for keys in the X:~/.ssh. How can I get around this?


Ok, I found a solution. On system X, I create a ~/.ssh/config section for Y which is something like:

Host Y
    IdentityFile ~/.ssh/id_Y.pub

where ~/.ssh/id_Y.pub is a copy (on X) of the public key for local to Y. sshd only needs to know where the public key is, it will find out everything else it needs from the agent.

  • OMG, I've been searching for this solution everywhere! – winni2k Jan 17 '18 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.