How to forward local keypair in a SSH session?

Question

I manually deploy websites through SSH, I manage source code in github/bitbucket. For every new site I'm currently generating a new keypair on the server and adding it to github/bitbucket, so that I can pull chances from server.

I came across a feature in capistrano to use local machine's key pair for pulling updates to server, which is ssh_options[:forward_agent] = true

How can I do something like this and forward my local machine's keypair to the server I'm SSH-ing into, so that I can avoid adding keys into github/bitbucket for every new site.

score 92 · Accepted Answer · answered Sep 13 '12 at 15:02

92

This turned out to be very simple, complete guide is here Using SSH Forwarding

In essence, you need to create a ~/.ssh/config file, if it doesn't exist.

Then, add the hosts (either domain name or IP address in the file and set ForwardAgent yes)

Sample Code:

Host example.com
    ForwardAgent yes

Makes SSH life a lot easier.

answered Sep 13 '12 at 15:02

Sathish Manohar

5,859
10
37
47

11

Great article linked in the answer; to summarize for OSX users you may need to `sudo vim /etc/ssh_config` and remove the `ForwardAgent no` host wildcard disable and then `ssh-add ~/.ssh/your_key` to allow the local agent to forward that identity. – cfeduke Feb 19 '14 at 16:11
Adding `echo 'Host example.com\n ForwardAgent yes' >> ~/.ssh/config` will not work if you connect to ssh using public ip `ssh node-1.example.com` then try to hop with `ssh ${user}@$(hostname -s)` using agent forward. It will ask for your password. – Dimitri Kopriwa Jan 21 '16 at 14:26
10

on my OSX El Capitan I did not need to mess around with /etc/ssh_config at all, but I did need to run `ssh-add` before the forwarding would work for me. – Randy L Mar 10 '16 at 20:55

score 55 · Answer 2 · answered Sep 18 '17 at 21:20

Create ~/.ssh/config
Fill it with (host address is the address of the host you want to allow creds to be forwarded to):
```
Host [host address]
     ForwardAgent yes
```
If you haven't already run ssh-agent, run it:
```
ssh-agent
```
Take the output from that command and paste it into the terminal. This will set the environment variables that need to be set for agent forwarding to work. Optionally, you can replace this and step 3 with:
```
eval "$(ssh-agent)"
```

Add the key you want forwarded to the ssh agent:

ssh-add [path to key if there is one]/[key_name].pem

Log into the remote host:
```
ssh -A [user]@[hostname]
```
From here, if you log into another host that accepts that key, it will just work:
```
ssh [user]@[hostname]
```

Also simply `ssh -o ForwardAgent=yes root@x.x.x.x` for a one-off. — deed02392, Oct 06 '20 at 10:58

score 7 · Answer 3 · answered Nov 17 '21 at 18:06

7

To use it simply with the default identity (id_rsa) you can use the following couple of command:

ssh-add
ssh -A [username]@[server-address]

answered Nov 17 '21 at 18:06

Nek

2,715
1
20
34

1

This is exacly that I need! `ssh-add` is the answer. thanks – HerberthObregon Feb 10 '23 at 09:55

score 1 · Answer 4 · edited May 23 '17 at 11:33

1

The configuration file is very helpful but the trick for agent forwarding does the ssh-add command. It seems that this have to be initial triggered before any remote connections or after restart of the computer. To permanently add the key try the following solution from the user daminetreg: Add private key permanently with ssh-add on Ubuntu

edited May 23 '17 at 11:33

Community

1
1

answered Apr 24 '17 at 08:47

Faulancer

9
1
4

score -2 · Answer 5 · answered Aug 20 '22 at 08:18

-2

It is very useful :

ssh -i [private-key] -A [user]@[host]

You can set one command in bash_aliases or other command routines.

answered Aug 20 '22 at 08:18

Mehdiable

86
8

How to forward local keypair in a SSH session?

5 Answers5

Linked