0

I have three systems:

  • New MBP (Catalina)
  • Old MBP (El Capitan)
  • Raspberry Pi (Raspbian Buster)

I want to SSH from the New MBP to the Old MBP, and then SSH from the Old MBP to the Raspberry Pi. My final goal is to set-up an rsync backup scheme between the Raspberry Pi and the Old MBP.

✅ I can SSH from the New MBP to the Old MBP without a problem.
✅ When I open screen sharing on the New MBP, connect to Old MBP and SSH from the Old MBP to the Raspberry Pi it works without a problem.
❌ When I SSH from the New MBP to the Old MBP, I can SSH from the Old MBP to the Raspberry Pi, but everytime it asks for a passphrase of the SSH key.

I followed these steps and found I had to set-up some different things as well on the Old MBP before they worked. So the complete things I did are:

  1. SSH from New MBP to Old MBP
  2. Start an SSH agent on the Old MBP: eval "$(ssh-agent -s)"
  3. Add the key: ssh-add -K ~/.ssh/id_rsa and ssh-add -A
  4. Now I can SSH to the Raspberry Pi without a password prompt: ssh user@raspi

As long as I don't logout of the Old MBP session (from step 1) everything is fine. However, if I:

  • close the New-Old SSH connection
  • re-connect from the New MBP to the Old MBP
  • Try to SSH to the Raspberry Pi

I get prompted for a passphrase again!

How can I get the ssh-agent on the Old MBP remember the passphrase across different SSH sessions?

1

This answer provided me with a solution.

By using ssh -A user@new-mbp and then ssh user@raspi I re-use the ssh-agent of the New MBP (if I understand it correctly) on the Old MBP and can login on the Raspberry Pi using an SSH key without being prompted for a password.

1
  • This unfortunately stops working when using tmux on the Old MBP..., but that's another question. – Saaru Lindestøkke Sep 27 '20 at 19:56
0

Jump Hosts

Consider using ssh's ProxyJump directive to achieve your chained connections:

The main method is to use an SSH connection to forward the SSH protocol through one or more jump hosts, using the ProxyJump directive, to an SSH server running on the target destination host. This is the most secure method because encryption is end-to-end. In addition to whatever other encryption goes on, the end points of the chain encrypt and decrypt each other's traffic. So the traffic passing through the intermediate hosts is always encrypted. But this method cannot be used if the intermediate hosts deny port forwarding.

See also Khris Tolbert's Proxyjump, the SSH option you probably never heard of

1
  • Thanks! I might misunderstand, but this is for the case if I want to connect from the New MBP to the Raspberry Pi, via the Old MBP, right? I want to connect from the Old MBP to the Raspberry Pi as the backup should end up at the Old MBP, not at the New MBP. I want to control this all from the New MBP to not have to walk over to the Old MBP. I found now that re-using the ssh-agent is probably what I want, but I can't figure out (yet) how to configure it. – Saaru Lindestøkke Sep 27 '20 at 18:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .