So I have a weird ssh problem with agent fowarding I'm trying to debug. I have a number of machines inside a firewall I can access via proxy, or directly if I'm connected inside the firewall. Everything works fine except for one case -- one machine if I connect to it via the proxy and then try to do anything with the ssh-agent (forwarded via the ssh agent forwarding), it locks up -- the connection hangs and eventually times out, disconnecting the ssh session. As long as I don't do anything that tries to access the agent it works fine. But even an
ssh-add -l locks up.
This only happens with one host, and only when connecting via the proxy. Other hosts via the proxy or this host directly (when inside the firewall) all work fine.
So my question is, how do I go about debugging this? I've tried using
ssh -v when connecting to get some info about what is going on. When I use that in a working case, I see something like:
$ ssh-add -l debug1: client_input_channel_open: ctype email@example.com rchan 2 win 65536 max 16384 debug1: channel 1: new [authentication agent connection] debug1: confirm firstname.lastname@example.org debug1: channel 1: FORCE input drain ...key fingerprints from the agent.
But in the non-working case I just get
$ ssh-add -l debug1: client_input_channel_open: ctype email@example.com rchan 2 win 65536 max 16384 debug1: channel 1: new [authentication agent connection] debug1: confirm firstname.lastname@example.org
and then it hangs (and times out after a couple of minutes, disconnecting the entire ssh session.)
All hosts in question are running
OpenSSH_7.2p2 Ubuntu-4ubuntu2.8, OpenSSL 1.0.2g 1 Mar 2016
I'm doing the proxying with
ProxyCommand /bin/nc -x proxy_host:1080 %h %p
and the agent forwarding with
in my .ssh/config file. I've stripped this down as much as possible (so removed everything else from the config file, with no change in behavior).
On the target machine, the agent socket looks normal:
--> echo $SSH_AUTH_SOCK /tmp/ssh-WMT414Uq0q/agent.2170 --> ls -l $SSH_AUTH_SOCK srwxrwxr-x 1 cdodd cdodd 0 Apr 2 09:06 /tmp/ssh-TTx7SEvwkx/agent.2170=