I have a control server (CS) that has SSH access to many others (H1, H2, etc). I would like CS to be able to initiate a rsync transfer between any two H* servers without those hosts knowing how to directly connect to each other.

I've looked at local/reverse port forwarding, but it seems that is only useful when H1 and H2 cannot directly talk to each other on the network. H1 still needs an authorized key on H2 for it to work, which is something I want to avoid.

Agent forwarding reads like it has the drawback of allowing an untrusted H1 to use any of my keys to the other hosts. I don't want H1 to gain access to anything else, only H2 for the duration of the transfer.

Is there a way I can establish SSH connections from CS to H1 and from CS to H2, and then have rsync (on either CS or H1) communicate via those channels to H2 without requiring additional authentication? Something like a command tunnel that is preauthorized?

  • What software do the hosts run – all OpenSSH?
    – user1686
    Nov 16, 2018 at 8:13
  • Yes. OpenSSH on all servers, latest releases from CentOS and Ubuntu repos.
    – jimp
    Nov 16, 2018 at 18:09
  • Do you need rsync, or would scp work? Nov 17, 2018 at 7:43
  • I’m actually using both. I would appreciate an answer for scp, so I don’t have to rewrite those commands, but I don’t think I can do without rsync because of its whole tree capabilities.
    – jimp
    Nov 17, 2018 at 15:03


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.