How configure SSH to connect to a host via proxy using one SSH key

Question

I have a network topology like this:

Laptop -> Bastion -> Destination 

Bastion and Destination are EC2 instances using the same SSH key for SSH access. However, Destination cannot be accessed from the Internet. Its IP address is visible only to Bastion.

I am able to connect to the Bastion and use agent forwarding to pass the SSH key over and then connect separately from the Bastion to the Destination server. However, I'd like to configure my .ssh/config file in such a way that I can SSH to the Destination server using one command from the laptop. My current .ssh/config file looks like this:

Host Bastion Hostname <redacted> IdentityFile ~/.ssh/mykey.pem Host Destination Hostname <redacted> User ubuntu ProxyCommand ssh -A bastion-dev -W %h:%p 

But when I run

ssh -A ubuntu@Destination 

SSH responds with:

Permission denied (publickey). ssh_exchange_identification: Connection closed by remote host 

How do I correctly pass the SSH key from my local to the Bastion server without having to store it on the server? Can I configure all this via .ssh/config file so that I can log into the Destination server with a single command?

Answer 1

Debug with one or more ssh -v flags from from the client and check the logs on the relevant server to see where the problem is.

All too frequently I have different keys for different customers, sites and projects, and I run into a MaxAuthTries setting of the remote ssh server when ssh-agent is still trying every potential key and hasn't reached the correct one yet. Check you server logs for that.

Also typically the username on my workstation won't match to the one that gets assigned on either Bastion or Destination so I prefer to set all settings explicitly in my configs. That way I won't need to use any commandline flags and can simply type ssh Destination and be done with.

Host Bastion Hostname bastion.example.com User hbruijn-adm ForwardAgent yes AddKeysToAgent yes UseKeychain yes # Specific to OS X IdentityFile ~/.ssh/id_rsa.bastion Host Destination Hostname destination.example.com User ubuntu ForwardAgent yes AddKeysToAgent yes UseKeychain yes # Specific to OS X IdentityFile ~/.ssh/id_rsa.destination ProxyJump Bastion 

ProxyJump is a relatively new setting that I find somewhat more intuitive to use then a ProxyCommand.