I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation:

My desktop computer with smartcard has a ssh session to shell.provider.com. From shell.provider.com I have a ssh session to shell.provider2.com (I sometimes call this situation 'hopping over')

My smartcard is inserted in the desktop computer. Is it (in any way) possible to use smartcard authentication to login to shell.provider2.com?

2 Answers 2


You can use ssh-agent to add a smart card and then forward agent to the other host. This will let you authenticate on the second host from the first using your local smartcard. In short:

eval `ssh-agent`               # if the agent is not running yet
ssh-add -s /path/to/pkcs11.so  # probably /usr/lib64/opensc-pkcs11.so
                   # or Ubuntu: /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so
# enter your pin
ssh-add -l                     # should list your smartcard
ssh -A shell.provider.com      # should not prompt for pin
ssh shell.provider2.com        # from the shell.provider.com
  • I don't think this works. The OP wants the second login to be initiated from the remote machine. Running ssh-agent locally won't help Jun 10, 2016 at 22:57
  • 1
    @NeilSmithline This is why the agent is forwarded using the -A switch. The last command is not run on the desktop, but on the first shell
    – Jakuje
    Jun 11, 2016 at 7:13
  • I didn't know about the -A option. I will try. Thanks! Jun 11, 2016 at 9:02
  • 1
    @Jakuje cool. Didn't know about that. Thx Jun 11, 2016 at 14:18
  • Does this work across OS's? My OS X based agent shows up as /usr/lib/ssh-keychain.dylib on linux, but ssh'ing on linux shows errors retrieving the keys: pkcs11_add_provider: provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so returned no slots
    – Drew
    Jan 31, 2019 at 16:11

Solutions for a smartcard can be

  • using agent-forwarding or
  • (with and without sc) using a proxycommand for ssh.

You could use a dedicated configuration for this in ~/.ssh/config by using a configuration for host B, or use it as a parameter in an ssh invocation.

Host B
  Hostname <the-real-hostname-for-B>
  User <user>
  Port 22
  ProxyCommand ssh -p 22 -q -W %h:%p <the-real-hostname-for-A>

an advantage is that you will have an alias for the host and also have code completion (less typing)

ssh <user>@B

TAKE CARE: agent forwarding is a bad practice on a shared machine, since it is extremely easy to hijack your agent via the environment variable SSH_AUTH_SOCK so that an attacker can take over your identity AND authentication mechanism to hop to other hosts.
When using yubikeys as your smartcard, you can use the feature that you need to physically touch your smartcard when a cryptographic operation is required like logging in. this way, the attacker also needs physical acccess to your smartcard, twharting the attack in most cases.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .