How did I login to another server without my private key?

Question

I just had a very scary moment, which forced me to wonder about the security of my private SSH key.

Here's what happened:

1. Logged into my server using my SSH key.
2. Gave the entry for my public key in .ssh/authorized_keys to my friend.
3. He placed that in his authorized_keys for a new account he made for me to login to.
4. Logged in from my server to his server using my SSH key.

Now what doesn't make sense here is how I managed to use my SSH key to login to his server from my server. My server does not have my private key. How was I able to log in from it? Could my private key be somewhere on my server even though I never placed it there?

Contents of authorized_keys on both servers:

ssh-rsa AAAAB3NzaC1yc2EAAAAD[more characters]FdQCw== robo@robo-ubuntu

Some extra info:

robo@other-server:~$ ssh robo@localhost
robo@localhost's password: 
Login Success. [More default login info]
robo@other-server:~$

My server runs on a non-default SSH port.

robo@my-server:~$ ssh -p [port number] robo@localhost
Login Success. [More default login info]
robo@my-server:~$ ls .ssh
authorized_keys  known_hosts
robo@my-server:~$ ssh -p [port number] robo@localhost
robo@localhost's password:
Login Success. [More default login info]
robo@my-server:~$ 

Notice how SSHing in twice to the localhost does not automatically login.

So apparently my key is getting forwarded? Here's what my config seems to say about that:

robo@my-server:~$ cd /etc/ssh/; grep -iR "forward"
sshd_config:X11Forwarding yes
ssh_config:#   ForwardAgent no
ssh_config:#   ForwardX11 no
ssh_config:#   ForwardX11Trusted yes
robo@roboserver:/etc/ssh$

I see two different "Forward"s that could be it. However, it seems to suggest that it is not forwarding the authentication.

Answer 1

Your desktop client uses an SSH agent. You can easily check if your connection has an agent running and if so if it is filled with your ssh keys by typing the following on the commandline:

ssh-add -L

Another possibility could be the use of the predefined identity file as defined by the 'IdentityFile' parameter in your global ssh config file /etc/ssh/ssh_config or your local ssh config file ~/.ssh/config

The way to figure out which key it has been using is to use a more verbose ssh output:

ssh -vv user@host