I have two SSH keys on my local PC - one to access my bastion and one to access my private server, behind the bastion.
As per Scp over a proxy with one command from local machine?, I can provide a single proxy command to provide seemless access to my private server from my local PC:
Host bastion
<bastion connection details as per usual>
Host private
ProxyCommand ssh bastion -W %h:%p
<private connection details as per usual>
The works great, but it exposes a security hole if I'm using Agent Forwarding to authenticate - Both my Bastion and Private server keys are forwarded to the Private server.
This is obviously not ideal - the Bastion private key has no place being available once we've proxy'd through it.
The only way around this I've found is to abandon the ProxyCommand
and use a 2 step ssh like so, extending the direct Host
section for the bastion itself. This assumes a further config file on the bastion to define host private
from there.
Host bastion private
<bastion connection details as per usual>
Host private
RequestTTY force
RemoteCommand afssh -c /path/to/private/key -- private
I don't think there is anything wrong with this from a security point of view, but it's a bit clunky, and doesn't work for scp
for example, so I was wondering if there is a better way of doing this?
You may think I could just call afssh
from the local PC, but given it's a wrapper around SSH, this filters out the bastion key before starting the proxy connection and thus prompts for the passphrase on execution of the ProxyCommand
which is even more clunky.
Thanks for any advice!
ssh-add -l
on the private server and see that my bastion key available in the agent on the private server. This means for certain, that I, and technically others on the private server can hijack this. The safest way to avoid this is to not forward any key that isn't required. – Phil May 3 '19 at 21:41