Ssh Agent Forwarding: Difference between revisions
Jump to navigation
Jump to search
| Line 12: | Line 12: | ||
=Overview= | =Overview= | ||
Agent forwarding means using the local identity (private key) from the machine that initiated the ssh connection on the remote machine - the machine you're logging into. This mode allows you to authenticate against further machines you may log into, with your local credentials, while logged in on the remote machine, without copying your private key on the remote machine. | Agent forwarding means using the local identity (private key) from the machine that initiated the ssh connection on the remote machine - the machine you're logging into. This mode allows you to authenticate against further machines you may log into, with your local credentials, while logged in on the remote machine, without copying your private key on the remote machine. This model works well for SSH proxies, usually found on bastions. | ||
To use it, first you need to add the private key identity you want to use to the authentication agent: | To use it, first you need to add the private key identity you want to use to the authentication agent: | ||
| Line 23: | Line 23: | ||
This forwards the connection to your [[OpenSSH_Concepts#ssh_Agent|ssh agent]] on the remote computer. | This forwards the connection to your [[OpenSSH_Concepts#ssh_Agent|ssh agent]] on the remote computer. | ||
To list all identities the SSH agent is aware of at the moment: | |||
ssh-add -l | |||
Revision as of 00:14, 7 December 2019
External
- https://yakking.branchable.com/posts/ssh-A/
- https://dev.to/levivm/how-to-use-ssh-and-ssh-agent-forwarding-more-secure-ssh-2c32
- https://developer.github.com/v3/guides/using-ssh-agent-forwarding/
Internal
Overview
Agent forwarding means using the local identity (private key) from the machine that initiated the ssh connection on the remote machine - the machine you're logging into. This mode allows you to authenticate against further machines you may log into, with your local credentials, while logged in on the remote machine, without copying your private key on the remote machine. This model works well for SSH proxies, usually found on bastions.
To use it, first you need to add the private key identity you want to use to the authentication agent:
ssh-add ~/.ssh/id_rsa
Then you connect with using the -A option:
ssh -A ...
This forwards the connection to your ssh agent on the remote computer.
To list all identities the SSH agent is aware of at the moment:
ssh-add -l