I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation:

My desktop computer with smartcard has a ssh session to shell.provider.com. From shell.provider.com I have a ssh session to shell.provider2.com (I sometimes call this situation 'hopping over')

My smartcard is inserted in the desktop computer. Is it (in any way) possible to use smartcard authentication to login to shell.provider2.com?


You can use ssh-agent to add a smart card and then forward agent to the other host. This will let you authenticate on the second host from the first using your local smartcard. In short:

eval `ssh-agent`               # if the agent is not running yet
ssh-add -s /path/to/pkcs11.so  # probably /usr/lib64/opensc-pkcs11.so
                   # or Ubuntu: /usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so
# enter your pin
ssh-add -l                     # should list your smartcard
ssh -A shell.provider.com      # should not prompt for pin
ssh shell.provider2.com        # from the shell.provider.com
| improve this answer | |
  • I don't think this works. The OP wants the second login to be initiated from the remote machine. Running ssh-agent locally won't help – Neil Smithline Jun 10 '16 at 22:57
  • 1
    @NeilSmithline This is why the agent is forwarded using the -A switch. The last command is not run on the desktop, but on the first shell – Jakuje Jun 11 '16 at 7:13
  • I didn't know about the -A option. I will try. Thanks! – user3555835 Jun 11 '16 at 9:02
  • 1
    @Jakuje cool. Didn't know about that. Thx – Neil Smithline Jun 11 '16 at 14:18
  • Does this work across OS's? My OS X based agent shows up as /usr/lib/ssh-keychain.dylib on linux, but ssh'ing on linux shows errors retrieving the keys: pkcs11_add_provider: provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so returned no slots – Drew Jan 31 '19 at 16:11

Solutions for a smartcard can be

  • using agent-forwarding or
  • (with and without sc) using a proxycommand for ssh.

You could use a dedicated configuration for this in ~/.ssh/config by using a configuration for host B, or use it as a parameter in an ssh invocation.

Host B
  Hostname <the-real-hostname-for-B>
  User <user>
  Port 22
  ProxyCommand ssh -p 22 -q -W %h:%p <the-real-hostname-for-A>

an advantage is that you will have an alias for the host and also have code completion (less typing)

ssh <user>@B

TAKE CARE: agent forwarding is a bad practice on a shared machine, since it is extremely easy to hijack your agent via the environment variable SSH_AUTH_SOCK so that an attacker can take over your identity AND authentication mechanism to hop to other hosts.
When using yubikeys as your smartcard, you can use the feature that you need to physically touch your smartcard when a cryptographic operation is required like logging in. this way, the attacker also needs physical acccess to your smartcard, twharting the attack in most cases.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.