How to ssh to a server via bastion(proxy) with key from the bastion(proxy) NOT origin

Question

So I'm essentially trying to do this:

ssh bob2@35.192.152.35 -t ssh bob2@test-vm

the above works fine if I just put it into the terminal, however I am having a hard time trying to replicate it via the .ssh config file.

Here's what I have inside the config file:

Host bastion
     HostName 35.192.152.35
     User bob2

Host test-vm
     User bob2
     FOrwardAgent yes
     ProxyCommand ssh bastion nc %h %p 2> /dev/null

However it comes up with an error saying "permission denied", invalid public key file? I came up with the above from this post: https://unix.stackexchange.com/questions/124078/how-to-ssh-to-a-server-using-another-server-with-key-from-the-second-server

Somehow it worked for the guy, but doesn't seem to work for me. I also tried allowing agent forwarding and TCP forwarding in the sshd_chroot config as well on all parties (origin, bastion, and server), but that didn't make a difference.

if I force specify the identity paths:

Host bastion
     HostName 35.192.152.35
     User bob2
     IdentityFile /Users/bob/.ssh/id_rsa

Host test-vm
     User bob2
     FOrwardAgent yes
     ProxyCommand ssh bastion nc %h %p 2> /dev/null
     IdentityFile /home/bob2/.ssh/id_ed25519

Then it comes up with the same error, in addition to saying that it couldn't find the directory "/home/bob2/.ssh/id_ed25519"

Anyone got any ideas?

@JohnHanley, not sure what you mean, replace the ProxyCommand with the proxyjump you suggested? It just gives me "ssh: Could not resolve hostname bob2: nodename nor servname provided..." — Dmytro Lysak, Apr 27 '22 at 18:59
I need to see exactly how you are using that command. Most likely you have not specified Hostname for the jump server. Edit your question with details. — John Hanley, Apr 27 '22 at 19:07
@JohnHanley , no that's exactly the same configuration, I have a VM on GCP called test-vm, and another VM on gcp called bastion, and I'm trying to ssh to the test-vm from my macbook via the bastion, using the ssh key from bastion > test-vm. A host name isn't required for test-vm due to on gcp you are able to ssh to other VMs on the same subnet via just the hostname rather than IP address. I did try with the IP address specified for test-vm as well though. — Dmytro Lysak, Apr 27 '22 at 20:07

3735943886 · Answer 1 · 2022-04-27T21:01:50.030

0

It seems that you want your config let test-vm look for key in bastion. So I suggest:

Copy key file to bob2’s .ssh folder in bastion.
add ProxyCommand with ssh-add in your config.

edited Apr 27 '22 at 21:01

answered Apr 27 '22 at 10:00

3735943886

71
1
6

Bob2's key file is already in bastion, that's why "ssh bob2@35.192.152.35 -t ssh bob2@test-vm" works but for some reason trying to replicate that in the config file doesn't. – Dmytro Lysak Apr 27 '22 at 19:02
Then try place test-vm’s key into client’s folder and change `IdentityFile /home/bob2/.ssh/id_ed25519` to `IdentityFile /Users/bob/.ssh/id_ed25519` from last configuration. – 3735943886 Apr 27 '22 at 20:53
I'm not exactly sure what you're asking, I am not allowed to move any of the keys between the servers, the test-vm has to use keys from the bastion, and the bastion cannot have any keys from the origin. – Dmytro Lysak Apr 27 '22 at 20:56
I found a similar question. Would you try solutions there? I think you need ssh-add in your configuration. https://serverfault.com/questions/337274/ssh-from-a-through-b-to-c-using-private-key-on-b – 3735943886 Apr 27 '22 at 21:00
I tried that one before submitting this question as well, sadly it doesn't work, gives me the same error. Maybe the ssh command works slightly differently on MacOS? Maybe that's why it doesn't work for me? – Dmytro Lysak Apr 28 '22 at 06:50

Bruce Chapman · Answer 2 · 2022-10-24T14:41:31.327

Below works for me ... Almost same as yours except I do specify the IP address of final destination (maybe not relevant in your case) and I HAD TO COPY the key from the bastion to my local host as my ssh_config is finding key files here not on the bastion midway :

==== added to .ssh/config ====
Host mybastion
    HostName 133.35.41.9
    User bastuser
    IdentityFile /Users/bchapman/.ssh/bast_priv.key

Host mytarget
    HostName 109.0.1.38
    ProxyCommand ssh -q -W %h:%p mybastion
    User targuser
    IdentityFile /Users/bchapman/.ssh/targ_priv.key
==============

After that I can ssh mytarget, scp localfile mytarget:, etc just fine

How to ssh to a server via bastion(proxy) with key from the bastion(proxy) NOT origin

2 Answers2