I'm working on a way to decentralise our SSH keys. The goal is to give each developer/admin/system manager a single SSH key.

This SSH key is added to the authorized_keys file on the bastion server. Now I have the command below that works perfectly when running as a terminal command:

ssh -t bastion@bastion.domain.tld ssh -i /home/bastion/.ssh/id_rsa target.domain.tld

Now I'm trying to convert this command into an ~/.ssh/config entry. But after many attempts, none have worked.

I have tried using the block below, but with this the target server is using the admin's SSH keys which of course doesn't succeed.

Host *.domain.tld !bastion.domain.tld
    ProxyJump bastion@bastion.domain.tld

I've also tried using nc, but this is giving me the same result.

Host *.domain.tld !bastion.domain.tld
  IdentityFile /home/bastion/.ssh/id_rsa
  ProxyCommand ssh bastion@bastion.domain.tld nc %h %p

What am I doing wrong here?

  • Try first to change the working command into one using -J. Then you can try to map that into an ~/.ssh/config with ProxyJump. – Eduardo Trápani Oct 21 at 15:33
  • 1
    Uh, I'm not entirely sure how making everyone use the same /home/bastion/.ssh/id_rsa constitutes decentralising SSH keys? – grawity Oct 21 at 15:45
  • Also look into using a CA to sign your keys, see e.g. here. It will make the setup with one key for each developer etc. a lot easier. – dirkt Oct 22 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.