0

So I have a weird ssh problem with agent fowarding I'm trying to debug. I have a number of machines inside a firewall I can access via proxy, or directly if I'm connected inside the firewall. Everything works fine except for one case -- one machine if I connect to it via the proxy and then try to do anything with the ssh-agent (forwarded via the ssh agent forwarding), it locks up -- the connection hangs and eventually times out, disconnecting the ssh session. As long as I don't do anything that tries to access the agent it works fine. But even an ssh-add -l locks up.

This only happens with one host, and only when connecting via the proxy. Other hosts via the proxy or this host directly (when inside the firewall) all work fine.

So my question is, how do I go about debugging this? I've tried using ssh -v when connecting to get some info about what is going on. When I use that in a working case, I see something like:

$ ssh-add -l
debug1: client_input_channel_open: ctype auth-agent@openssh.com rchan 2 win 65536 max 16384
debug1: channel 1: new [authentication agent connection]
debug1: confirm auth-agent@openssh.com
debug1: channel 1: FORCE input drain
...key fingerprints from the agent.

But in the non-working case I just get

$ ssh-add -l
debug1: client_input_channel_open: ctype auth-agent@openssh.com rchan 2 win 65536 max 16384
debug1: channel 1: new [authentication agent connection]
debug1: confirm auth-agent@openssh.com

and then it hangs (and times out after a couple of minutes, disconnecting the entire ssh session.)

All hosts in question are running OpenSSH_7.2p2 Ubuntu-4ubuntu2.8, OpenSSL 1.0.2g 1 Mar 2016

I'm doing the proxying with

ProxyCommand /bin/nc -x proxy_host:1080 %h %p

and the agent forwarding with

ForwardAgent yes

in my .ssh/config file. I've stripped this down as much as possible (so removed everything else from the config file, with no change in behavior).

On the target machine, the agent socket looks normal:

--> echo $SSH_AUTH_SOCK 
/tmp/ssh-WMT414Uq0q/agent.2170

--> ls -l $SSH_AUTH_SOCK
srwxrwxr-x 1 cdodd cdodd 0 Apr  2 09:06 /tmp/ssh-TTx7SEvwkx/agent.2170=
  • I'm without concrete evidence here, but it could be that admin of that one remote machine have turned off agent-forwarding in the /etc/ssh/sshd_config, which I could imagine might lead to oddities. Check that config file and see what it says. – crimson-egret Mar 30 at 15:56
  • No, because the agent forwarding works fine if I'm directly connected (not going through the proxy for the ssh connection) – Chris Dodd Mar 30 at 17:28
  • Please provide a clear example of the actual invocation of SSH you are using to get to the destination through the proxy. Without it, we can't really help more. – crimson-egret Mar 31 at 20:22
  • I'm just using ssh -v host to connect to the host -- using the noted ProxyCommand in my .ssh/config file to do the proxying. – Chris Dodd Mar 31 at 22:24
  • Yes, but are you also forwarding the agent through the proxy? Without all the various bits of configuration and invocations, it's not possible to see what's possibly wrong. At this moment I'd first suspect that the agent is not forwarding through the proxy and the socket left on the destination is a remnant of a previous invocation or somehow pointing "nowhere". – crimson-egret Apr 1 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.