TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Using ssh-agent with ssh (2002)

13 pointsby tonteldoosover 9 years ago

3 comments

jlgaddisover 9 years ago
I&#x27;m inclined to recommend against using `ssh-agent`. I suggest using ProxyCommand instead and I, myself, use that probably 50 times a day every day.<p>I have dozens of servers running Linux and FreeBSD that, naturally, have `sshd` enabled for remote access. Even though (almost) all of my servers have public IP addresses, there are only three of them accessible via SSH from &quot;the world&quot; -- two OpenBSD hosts and one RHEL host.<p>The two OpenBSD machines are &quot;jumpboxes&quot;: their only purpose is to serve as a gateway into the network and to all of the other servers. Instead of SSH&#x27;ing into one of them and then SSH&#x27;ing out to the actual machine I want to log into, I make heavy use of &quot;ProxyCommand&quot; in my $HOME&#x2F;.ssh&#x2F;config so that I can just run, e.g. &quot;ssh mx-out&quot;. An SSH connection to one of the jumpboxes is established and, through that, a connection to the actual server is then made. Since I use keys for authentication, I don&#x27;t have to enter my password or passphrase twice (or even once) and the &quot;magic&quot; is completely transparent to the user once it&#x27;s initially set up.<p>The RHEL host (which I&#x27;ve hardened as much as possible) is for web hosting customers to connect to in order to upload&#x2F;download files into their web space. It is not a web server, itself, but it is an NFS client so that customers don&#x27;t need to log into the actual web servers themselves.
bbrazilover 9 years ago
This is a good setup, I had similar years ago to deal with screen.<p>One general word of warning with ssh-agent: Only use -A to forward it to another host that you completely trust, as anyone with root on that machine will be able to use your private keys.
评论 #10142855 未加载
评论 #10142692 未加载
newman314over 9 years ago
Use ProxyCommand instead
评论 #10142864 未加载