Changes between Initial Version and Version 1 of HowTo/ForwardSSHAgent

Timestamp:

08/07/14 14:33:37 (10 years ago)

Author:

sedwards@bbn.com

Comment:

--

HowTo/ForwardSSHAgent

@@ +1 @@
+= How To Login to One Computer from Another =
+
+In GENI, it regularly comes up that folks want to login into one remote node from their local machine, then log into a second remote node directly from the first remote node.
+
+To do this, you need to enable ssh agent forwarding when you log into the first remote node. 
+
+If you are using ssh via a command line, you can simply add the `-A` option to your usual `ssh` command when you log into the ''first'' remote node.  This is mentioned in passing on the How To page for logging into nodes (search for "agent" in [2]).
+
+To summarize, the following sequence of commands should work:
+{{{
+local> ssh -A -i ~/.ssh/id_rsa firstnode.example.com
+firstnode> ssh secondnode.example.com
+secondnode>
+}}}
+
+If you are not using a command line ssh client you will need to find the appropriate option on your particular client. Hopefully some poking around and googling will readily turn up the answer.  
+
+== References ==
+`man ssh` includes this:
+{{{
+     -A      Enables forwarding of the authentication agent connection.  This
+             can also be specified on a per-host basis in a configuration
+             file.
+
+             Agent forwarding should be enabled with caution.  Users with the
+             ability to bypass file permissions on the remote host (for the
+             agent's UNIX-domain socket) can access the local agent through
+             the forwarded connection.  An attacker cannot obtain key material
+             from the agent, however they can perform operations on the keys
+             that enable them to authenticate using the identities loaded into
+             the agent.
+}}}