12

I couldn´t find my specific case in other threads.

Basically I have my PC (ubuntu), a proxy (Debian), and a target (Debian). I want to do a proxyjump from the PC to the target going through the proxy. Authentication from the proxy to the target and from the PC to the proxy use pubkey authentication and each machine has its own key pair.

The privkey in the PC matches the PC pubkey in the proxy and they are in the default directory. So, I just run ssh user@proxy in the PC and it connects fine to the proxy. In the proxy I have to specify ssh -i mypubkey user@targetserver to connect fine (it´s not the default key).

Now, from the PC, I don´t know how to run one command and end up in the target since I have to specify the privkey in the proxy. I tried:

ssh -J user@proxy user@target
ssh -Ao ProxyCommand="ssh -W %h:%p user@proxy" user@target

But it gives me error Permission denied (publickey).

In the proxy server I tried to add the IdentityFile directive in ~/.ssh/config and in /etc/ssh/ssh_config but apparently when I call the proxy from the PC as the jump host, it won´t take configurations from those files.

If I bring the privkey from the proxy to the PC and I specify with -i for example, it works (that would be ssh -i mypubkey -J user@proxy user@target). So my question is: is it possible to keep the privkey in the proxy and reference it in the PC so I don´t have to move it to the PC?

Improve this question
2
  • Isn't this the same question with a better answer? serverfault.com/questions/337274/…
    – yurtesen
    Nov 13, 2020 at 20:11
  • 2
    @yurtesen it doesn’t look like a better answer. The accepted answer there has netcat in the solution. Below’s explanation by crimson is to-the-point and clarifying. It does not suggests workarounds.
    – Adriano_pinaffo
    Nov 15, 2020 at 21:04

1 Answer 1

Reset to default
11

[...] is it possible to keep the privkey in the proxy and reference it in the PC so I don´t have to move it to the PC?

Short answer: No

Reason: All config file (or command-line) references on your local PC are to files residing on your local device (PC). You can't reference remote (proxy) files from your PC that ssh can access at the time ssh is trying to establish the connection.

Moreover: you probably don't want to store the private key for proxy-to-target access on the proxy; if you did, it would have to be a key with no passphrase, which is always bad security practice. In general, it's best to secure your private keys well. In my case, they only ever exist on my local machine, and always have good passphrases.

Suggested workaround: you've already got the setup working with the proxy-to-target key on your local PC. Either continue with that, or use ssh-agent and forwarding to provide password-less access I presume you want to keep. Example ~/.ssh/config entries:

Host target
    ProxyJump  user@proxy
    IdentityFile .../target-id_rsa

Host proxy
    IdentityFile .../proxy-id_rsa
    ForwardAgent yes

You can probably get away without the IdentityFile directives if you know you will have already loaded the keys into your local agent.

Improve this answer
1
  • I guess it makes sense. The same situation happens with TOR if I´m not mistaken.
    – Adriano_pinaffo
    Jun 8, 2018 at 17:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .