Differences

This shows you the differences between two versions of the page.

--- ubuntu:ssh:agent_forwarding [2025/05/21 10:00] – peter
+++ ubuntu:ssh:agent_forwarding [2025/05/21 10:11] (current) – peter
@@ Line 9: / Line 9: @@
   * Just make sure the keys are added to ssh-agent and configure ssh to use forwarding.
+----
+===== Manually enable SSH agent forwarding =====
+To enable SSH agent forwarding, use the **-A** option with the **ssh** command when connecting to your remote server.
+<code bash>
+ssh -A user@host
+</code>
+<WRAP info>
+**NOTE:**  This will bypass all config files.
+  * Agent forwarding can be configure permanently in the **~/.ssh/config** file by adding **ForwardAgent yes** under the host entry.
+</WRAP>
 ----
@@ Line 52: / Line 68: @@
 <WRAP info>
-**NOTE:** Replace <example> with the servers domain name or IP address.
+**NOTE:** Replace **<example>** with the servers domain name or IP address.
   * The wildcard ***** can be used for the host, but then this will be forwarding access of the private keys to every server being connected to, which is probably not what you want.
@@ Line 58: / Line 74: @@
 </WRAP>
+<WRAP important>
+**WARNING:**  There may also be a SSH config files at **/etc/ssh_config**, which may override the user config file at **~/.ssh/config**, so make sure nothing is conflicting.
+</WRAP>
 ----
-===== Enable SSH agent forwarding =====
+===== Troubleshooting =====
-To enable SSH agent forwarding, use the **-A** option with the **ssh** command when connecting to your remote server.
+If SSH Forwarding is not working,
+  * Make sure you actually have SSH keys in the first place; if you do not, run **ssh-keygen**, which will place the private key in **~/.ssh/id_rsa** and the public key in **~/.ssh/id_rsa.pub**.
+  * Verify that the SSH keys are working properly with regular auth, and add them to ssh-agent. Keys can be added with **ssh-add**.
+  * The ssh-agent process also needs to be running. It should start automatically, but verify that it is running with: <code bash>
+echo "$SSH_AUTH_SOCK"
+</code>
+  * If it is correctly set up, this should display a Listeners socket returned.
+  * Make sure the config files are set up properly to include **ForwardAgent yes**, and make sure no other config files are overwriting this behaviour.
+  * To check which config files SSH is using, run ssh in verbose mode, Which should display which config files are being used. Files displayed later in this list take precedence over earlier files: <code bash>
+ssh -v user@host</code>
+----
+TAGS
-  * Alternatively, configure it permanently in the **~/.ssh/config** file by adding **ForwardAgent yes** under the host entry.
+  * TAG:  Networking
+  * TAG:  Security
+  * TAG:  SSH
 ----