I have two SSH keys on my local PC - one to access my bastion and one to access my private server, behind the bastion.

As per Scp over a proxy with one command from local machine?, I can provide a single proxy command to provide seemless access to my private server from my local PC:

Host bastion
    <bastion connection details as per usual>

Host private
    ProxyCommand ssh bastion -W %h:%p
    <private connection details as per usual>

The works great, but it exposes a security hole if I'm using Agent Forwarding to authenticate - Both my Bastion and Private server keys are forwarded to the Private server.

This is obviously not ideal - the Bastion private key has no place being available once we've proxy'd through it.

The only way around this I've found is to abandon the ProxyCommand and use a 2 step ssh like so, extending the direct Host section for the bastion itself. This assumes a further config file on the bastion to define host private from there.

Host bastion private
    <bastion connection details as per usual>

Host private
    RequestTTY force
    RemoteCommand afssh -c /path/to/private/key -- private

I don't think there is anything wrong with this from a security point of view, but it's a bit clunky, and doesn't work for scp for example, so I was wondering if there is a better way of doing this?

You may think I could just call afssh from the local PC, but given it's a wrapper around SSH, this filters out the bastion key before starting the proxy connection and thus prompts for the passphrase on execution of the ProxyCommand which is even more clunky.

Thanks for any advice!

  • What makes you believe private keys are forwarded? Public keys are forwarded, private keys are never revealed. One-way algorythms are used to derive a common key without sharing the private key. Public keys do not have enough information to derive the private keys and can be broadcast widely. – davidgo May 3 '19 at 20:26
  • I can ssh-add -l on the private server and see that my bastion key available in the agent on the private server. This means for certain, that I, and technically others on the private server can hijack this. The safest way to avoid this is to not forward any key that isn't required. – Phil May 3 '19 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.