1

I'm trying to create an ssh tunnel to access a remote server(A) that can only be accessed via another server(B). I have a key on my local machine(L) to get to the relay server(B) and another key on the relay server(B) to get to the destination server(A).

[local machine(L) with key to relay server(B)] --> [relay server(B) with key to destination server (A)] --> [destination server (A)]

I have a ~/.ssh/config file that looks like this on my local machine(L):

Host relay.server(B)
    Hostname relay.server
    Port 22
    User me
    IdentityFile ~/.ssh/id_rsa

Host destination.server(A)
    Hostname destination.server
    Port 1122
    User me
    IdentityFile ~/.ssh/id_rsa

And I can cludigly get my tunnel working with the following:

running the command: ssh -N -L 1122:SERVER_PRIVATE_IP:22 relay.server(B) on my local machine(L). This prompts me for a password to unlock the first key and then appears to hang it does not return a prompt, using the -f option or ending with an & prevents me from entering the password. However if I ^C this command after entering the password and then enter ssh destination.server(A) I get a prompt to provide a password to unlock the second key afterwhich I am connected to the destination server(A).

I'm looking for a single command that will let me connect to the destination server(A) from my local machine(L) and will prompt me to provide the passwords needed to unlock each key. Or a suggestion for an alternate way of organising things so that I can connect straight to the destination server(A) from my local machine (L) via the relay server (B).

  • Thanks for clarifying. I was going to suggest -f; I’m sorry to hear that it didn’t work. (You’re sure that you tried -f without &?) I’m out of ideas; good luck. – Scott Mar 2 '18 at 19:14
2

The short answer is you need

  • ProxyCommand using nc to connect through
  • ForwardAgent to pass along keys
  • ensure your public key is part of .ssh/authorized_keys on all servers
Host relay
    Hostname        relay.server.fqdn.or.IP
    User            me
    IdentityFile    ~/.ssh/id_rsa
    ForwardAgent    yes

Host destination
    Hostname        destination.server.fqdn.or.IP
    User            me
    IdentityFile    ~/.ssh/id_rsa
    ProxyCommand    ssh -q relay "nc %h %p"
    ForwardAgent    yes

The longer portion.

The ProxyCommand option in ssh config runs a command whenever that enclosing Host is used. It's typically used with nc available from nmap.org, also known as ncat and has lots of options.

In the above Host destination entry of ssh config, ProxyCommand was set to ssh -q relay "nc %h %p" which says, ssh to relay quietly and run nc destination.server.fqdn.or.IP 22.

nc makes the connection between the incoming ssh and the destination.

The ForwardAgent yes tells ssh to add the key to an ssh-agent. ssh agents keep track of the keys and are used to automatically pass the right one to a host as needed. The ForwardAgent yes tells the agent to pass the key along to another agent on the relay and then again to the destination.

Now for all this to work, each server you hop through and ultimately the destination must have the public key associated with your private key (id_rsa) in its .ssh/authorized_keys file. When you created your private key, id_rsa, a public key, id_rsa.pub, should also have been created.

If you don't have your public key, you can always get it from the private key via ssh-keygen -y -f ~/.ssh/id_rsa for easy copy/paste. Note that the public key has 2 or 3 space-separated fields but is one line.

So, ssh relay, edit ~/.ssh/authorized_keys (which may not exist, so mkdir -p ~/.ssh may be necessary) and paste the public key on a new line (or the first if not present).

While on the relay server, check that nc exists in /bin or /usr/bin. If it doesn't, then you'll need to install it using your package manager, either yum or apt-get.

From the relay server, ssh destination and do the same update of ~/.ssh/authorized_keys.

exit out all the way to your local machine, and you should be able to ssh destination

| improve this answer | |
1

Newer OpenSSH versions allow ProxyJump in .ssh/config:

Host relay
    Hostname        relay.server.fqdn.or.IP
    User            me
    IdentityFile    ~/.ssh/id_rsa
    ForwardAgent    yes

Host destination
    Hostname        destination.server.fqdn.or.IP
    ProxyJump       relay
    User            me
    IdentityFile    ~/.ssh/id_rsa

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.