SSH key Forwarding (Linux and Windows)

Preface

General company's servers in the external network, will be set up a springboard machine, access to the company's other servers need to do an SSH jump from the Springboard machine (firewall rules will do the corresponding configuration), and the previous article, the external network of the server basically through the certificate login. So we face a situation, this machine ssh-> springboard machine and Target machine. If it is password authentication, this problem is not, but for the certificate login, it brings an SSH key forwarding problem.

Linux SSH client key forwarding

In the case of a Linux client, the SSH jumps from the Linux client to the past, usually we execute the command

SSH [email protected] Springboard machine IP

And then we jump to the target machine on the jump machine.

SSH [email protected] Target machine IP

The springboard IP and target machine ip,blue account are already in the corresponding. Ssh/authorized_keys added the public key, configuration is no problem, but we will encounter an error, called PubKey Unauthorization, because the springboard machine does not have blue private key. The problem is always there, the solution is always there, SSH is the function of the forwarding key, so we jump from the local to the board machine is, you can forward the private key to the past.

So the right thing to do is to execute the command on a native Linux client

ssh-a [email protected] Springboard machine IP

-a means that the key is forwarded, so jump to the board and the key is forwarded over.

Next, we'll execute the order on the board.

ssh-a [email protected] Target machine IP

The-a parameter here is not necessary, and you do not need to continue to forward the key if you do not need to jump from the target machine to another target machine.

Alternatively, you can configure the default configuration file for the native Client to change to the default forwarding key:

Modify Ssh_config (not sshd_config, generally in/etc or/ETC/SSH): Change #forwardagent No to Forwardagent Yes

Whether the board needs to be configured, in the same vein, reference your needs.

Windows SecureCRT key forwarding

Under Windows SECURECRT Configure proxy forwarding, you need to do the following settings

SSH key Forwarding (Linux and Windows)