24

This guide does a great job explaining how ssh-agent works across multiple systems. I'd like to get forwarding set up as it is in the last set of diagrams, but I'm having trouble tracking down the steps required to do so.

For some machines on my network, I can ssh from A to B, then B to C, without ever entering a cert password. Other machines, however, give a "Could not open a connection to your authentication agent" (sometimes!), then won't forward my authentication info. SSHing from one of these machines to another box on the network prompts for my private-key password again.

I didn't build these machines, but I can administer some of them. I don't know for sure what the difference is between boxen that work and the ones that don't -- could be a firewall issue, ssh/ssh-agent/sshd configuration, anything, and I don't see any step-by-step guides specific to forwarding floating around the 'net. I just need to know where to start chasing this issue down.

Coderer
  • 1,700

2 Answers2

25

Ssh agent forwarding must be allowed on the client (ForwardAgent option in ~/.ssh/config) and on the server (AllowAgentForwarding option in sshd_config). Chances are that your machines have different default settings for one or both of these options.

If you're going A->B->C, forwarding is not necessary on the B->C step (unless you're then going to go C->D of course).

When you're logged into B, check that the environment variable SSH_AUTH_SOCK is defined. Its value is how ssh knows how to contact the agent.

There's no good reason to forbid agent forwarding in the server, given that agent forwarding makes the client vulnerable to the server and not the opposite, and that you could in principle set up agent forwarding manually (although there wouldn't be so much point since the difficulty of setting it up would defeat the point of the convenience of agent forwarding).

Gilles 'SO- stop being evil'
  • 72,151
15

While you already have the right answer by @Gilles above, I wanted to point out that AllowAgentForwarding is only supported in OpenSSH 5.1 onwards.

OpenSSH servers before 5.1, from what I have seen in my RHEL 4u5 box, allow agent forwarding by default. So if your server is older than 5.1 and agent forwarding is not working, the problem is likely in the ssh client. Since forwarding seems to be working for some machines for you, it seems that /etc/ssh/ssh_config is setup fine. Check ~/.ssh/config to see if there is any exception made to disable agent forwarding for the affected boxes.

Ref: http://www.openssh.org/txt/release-5.1

Sandip Bhattacharya
  • 281