Ssh – pssh and ssh-agent key forwarding via jump host

sshssh-agent

I'm trying to connect to a number of hosts using pssh in combination with a jump host and ssh-agent key forwarding.

Unfortunately this fails quiet regular, but with different hosts failing on. So this is only an example which would look different next time:

 ~> pssh -h /tmp/hostfile -o /tmp/log  -e /tmp/error/ -v uname -a
[1] 13:51:18 [FAILURE]  host1 Exited with error code 255
[2] 13:51:19 [SUCCESS]  host2 
[3] 13:51:19 [SUCCESS]  host3 
[4] 13:51:19 [SUCCESS]  host4
[5] 13:51:19 [SUCCESS]  host5
[6] 13:51:19 [SUCCESS]  host6
[7] 13:51:19 [SUCCESS]  host7
….
[16] 13:51:19 [SUCCESS] host16

When having a deeper look, I'm getting

ssh_exchange_identification: Connection closed by remote host
ssh_exchange_identification: Connection closed by remote host

on the host that failed. This looks much like the ssh-agent keyforwarding via jump host did not work in this particular scenario.

Inside my ~.ssh/config it looks like this:

ForwardAgent yes

Host *.tld.foo
    User frlan
    ProxyCommand ssh tld-jump-host nc %h %p

Host tld-jump-host
    HostName myhost.example.com
    User frlan
    ProxyCommand none

Usually this is working. Now I'm wondering why starting at about 15 hosts sometime the key is not forwarded an dhow I can upgrade my configuration to prevent this from happening.

Best Answer

I'm trying to connect to a number of hosts using pssh in combination with a jump host and ssh-agent key forwarding.

For connections using ProxyCommand you do not need any ssh-agent forwarding. All the authentication is done directly from your computer.

Manual page for ssh_config says

For each parameter, the first obtained value will be used.

therefore the Host tld-jump-host block should be before Host *.tld.foo block, especially if the jump box has the same tld as the hosts behind it.

If you are connecting to many hosts behind this jump box, you might be triggering connection limit and the connections will get randomly rejected. You can try to avoid it by bumping the connection rate limit in jumpbox server (MaxStartups option in sshd_config), or multiplex the connections to the jump box by creating directory ~/.ssh/cm/ and adding the following to the jumbox block in ssh_config:

ControlMaster auto
ControlPath ~/.ssh/cm/%C
ControlPersist 5m

Related Solutions

Ssh – How to automate SSH session for a specific user from a specific IP

To answer your followup question, if you create your SSH keypair without a password, then you would not need to enter the password to connect the servers.

You would add the pubkey in .authorized_keys according to this paragraph:

Key Access Limits

As an optional step to limit usage of the public key for access to any servers, a from statement can be used before public key entries in the ~/.ssh/authorized_keys file on the servers to limit where the client system is permitted to access the server from. Without a from limit, any client system with the appropriate private key data will be able to connect to the server from anywhere. If the keypair should only work when the client system is connecting from a host under example.org, set from="*.example.org" before the public key data.
server$ cat ~/.ssh/authorized_keys
from="*.example.org" ssh-rsa AAAAB3NzaC1…

In the "from" you would put your local interface IP address(es). Using that plus a combination of using an ssh key without a password (which is not best practices, but for most systems will work fine), will accomplish what you are looking for.

Ssh-agent forwarding and sudo to another user

As you mentioned, the environment variables are removed by sudo, for security reasons.

But fortunately sudo is quite configurable: you can tell it precisely which environment variables you want to keep thanks to the env_keep configuration option in /etc/sudoers.

For agent forwarding, you need to keep the SSH_AUTH_SOCK environment variable. To do so, simply edit your /etc/sudoers configuration file (always using visudo) and set the env_keep option to the appropriate users. If you want this option to be set for all users, use the Defaults line like this:

Defaults    env_keep+=SSH_AUTH_SOCK

man sudoers for more details.

You should now be able to do something like this (provided user1's public key is present in ~/.ssh/authorized_keys in user1@serverA and user2@serverB, and serverA's /etc/sudoers file is setup as indicated above):

user1@mymachine> eval `ssh-agent`  # starts ssh-agent
user1@mymachine> ssh-add           # add user1's key to agent (requires pwd)
user1@mymachine> ssh -A serverA    # no pwd required + agent forwarding activated
user1@serverA> sudo su - user2     # sudo keeps agent forwarding active :-)
user2@serverA> ssh serverB         # goto user2@serverB w/o typing pwd again...
user2@serverB>                     # ...because forwarding still works

Best Answer

Related Solutions

Ssh – How to automate SSH session for a specific user from a specific IP

Ssh-agent forwarding and sudo to another user

Related Topic