I have a control server (CS) that has SSH access to many others (H1, H2, etc). I would like CS to be able to initiate a rsync transfer between any two H* servers without those hosts knowing how to directly connect to each other.
I've looked at local/reverse port forwarding, but it seems that is only useful when H1 and H2 cannot directly talk to each other on the network. H1 still needs an authorized key on H2 for it to work, which is something I want to avoid.
Agent forwarding reads like it has the drawback of allowing an untrusted H1 to use any of my keys to the other hosts. I don't want H1 to gain access to anything else, only H2 for the duration of the transfer.
Is there a way I can establish SSH connections from CS to H1 and from CS to H2, and then have rsync (on either CS or H1) communicate via those channels to H2 without requiring additional authentication? Something like a command tunnel that is preauthorized?