Why won't my SSH keys forward properly?

Question

I'm trying to ssh from my machine to another machine and from there to a third machine. When I do it manually, it works like this:

localhost$ scp ~/.ssh/id_rsa myuser@myhost.something.something.com:.
localhost$ ssh myuser@myhost.something.something.com
myhost.something.something.com$ ssh -i id_rsa myuser@10.25.100.42
10.25.100.42$

But I would like to do it directly, in one step. And I want my SSH keys from localhost to forward to the third machine. I thought this would work, but it doesn't:

localhost$ ssh -A -t myuser@myhost.something.something.com ssh 10.25.100.42
Permission denied (publickey).
Connection to myhost.something.something.com closed.

Why? How can I do this in a single command from localhost? Here is some more detail you can see when I use the verbose flag:

localhost$ ssh -v -A -t myuser@myhost.something.something.com ssh 10.25.100.42

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to myhost.something.something.com [X.X.X.X] port 22.
debug1: Connection established.
debug1: identity file /home/myuser/.ssh/id_rsa type 1
debug1: identity file /home/myuser/.ssh/id_rsa-cert type -1
debug1: identity file /home/myuser/.ssh/id_dsa type -1
debug1: identity file /home/myuser/.ssh/id_dsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 62:d2:58:47:f7:c6:21:b4:a1:b0:cf:4e:44:42:e4:9a
debug1: Host 'myhost.something.something.com' is known and matches the RSA host key.
debug1: Found key in /home/myuser/.ssh/known_hosts:255
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/myuser/.ssh/id_rsa
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to myhost.something.something.com ([X.X.X.X]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Requesting authentication agent forwarding.
debug1: Sending command: ssh 10.25.100.42
debug1: client_input_channel_open: ctype auth-agent@openssh.com rchan 2 win 65536 max 16384
debug1: channel 1: new [authentication agent connection]
debug1: confirm auth-agent@openssh.com
Permission denied (publickey).
debug1: channel 1: FORCE input drain
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 2
debug1: channel 1: free: authentication agent connection, nchannels 1
Connection to myhost.something.something.com closed.
Transferred: sent 3532, received 3312 bytes, in 4.4 seconds
Bytes per second: sent 796.1, received 746.6
debug1: Exit status 255

Could you run the `ssh-add -l` command and post the output here? — Jander, Mar 25 '16 at 07:57

score 7 · Accepted Answer · answered Mar 25 '16 at 10:55

If you want to forward connection to your authentication agent, you need to have the authentication agent running on your machine. You can check it using ssh-add -l. If it is not running, start it and add the keys:

eval `ssh-agent`
ssh-add ~/.ssh/id_rsa
# or other keys you want to use from the other server

and then after connecting to the other server with -A switch, you will be able to authenticate using this key further:

local     $ ssh -A myuser@myhost.something.something.com
something $ ssh-add -l                     # should list your key
something $ ssh 10.25.100.42

But what you are really trying to achieve is something different. You want to use first host as a jumpbox to connect to the second one and it can be made much more convenient using ProxyCommand:

ssh -oProxyCommand="ssh -W 10.25.100.42:22" myuser@myhost.something.something.com

or better with .ssh/config:

Host something
  Hostname myhost.something.something.com
  User myuser
Host second
  Hostname 10.25.100.42
  User myuser
  ProxyCommand ssh -W %h:%p something

and then you will get there just using

ssh second

Not only is `ProxyCommand` more convenient, it is also more secure. The private key is better protected that way. With agent forwarding the jump host could use the key to authenticate to any other host. Using `ProxyCommand` without any agent forwarding eliminates that weakness. Moreover when using `ProxyCommand` it is possible to harden the configuration of the jump host much more against attacks from outside. — kasperd, Apr 04 '16 at 10:57

Why won't my SSH keys forward properly?

1 Answers1