I have three systems , a client that only install ssh client and server_1 and server_2 . im using ssh public authentication and i can ssh from client to both server_1 and server_2. i saved same pub key for server 1 and and now i want to ssh from server 1 to server 2 using agent forwarding and i want my private key stay only on client please help me ASAP how can i do this scenario ? i use this link but dont know how to do it .

An Illustrated Guide to SSH Agent Forwarding: Public Key Access with Agent Forwarding


Forward server host to localhost :

ssh -L localhost:22:localhost:22 user@host


ssh -N -f -L serverhost:22:localhost:22 user@server1

After reading your question again.

You want to ssh into server1 :

ssh user@server1

Then you want to ssh into server2:

Into new terminal from client do:

ssh user@server1
ssh user@server2

Then you have 2 connections:

  1. client to server 1
  2. client to server 1 ==> server 2

If you want to have:

  1. client to server 1
  2. client to server 2 (With same key.)

Just do following command.

On client:

Use tmux or open 2 terminals

ssh user@server1

In new terminal:

ssh user@server2
  • it didnt helped no public key error Feb 20 '18 at 14:35
  • You want to forward or 'client to server1 and client to server2?'
    – An0n
    Feb 20 '18 at 14:37
  • same pub key is stored on both server and i can ssh from client to both . now i want to use ssh agent forwarding to ssh from server 1 to 2 without private key save on server like link above Feb 20 '18 at 14:41
  • Edited my answer.
    – An0n
    Feb 20 '18 at 14:46
  • ur right in this case . but how can ssh from server 1 to server 2 directly without ssh from client to server 1 using key request and response . imagine server 1 system is some place else and i want ssh from that system to server 2 not from client Feb 20 '18 at 14:55

First you have to invoke ssh-agent on your client to make it remember your key

ssh-agent -t 3600 ~/.ssh/private_key_rsa

(assuming that your key is stored in ~/.ssh/private_key_rsa, you can also leave out the -t 3600 if you want infinite lifetime)

then you simply ssh into one of your servers using the -A option

ssh -A server1

from there you will then be able to ssh into server2

ssh server2

If you do not want to specify the -A option everytime you can add the following to your ~/.ssh/config (on the client and optionally both servers)

Host server1
 ForwardAgent yes

Host server2
 ForwardAgent yes

This works for any number of servers. To keep the ~/.ssh/config short you can introduce wildcards e.g.

Host server?
  ForwardAgent yes
  • What about server3?
    – An0n
    Feb 21 '18 at 19:17
  • This works for any number of servers. (see also my recent edit). If all servers accept the same key you can do ssh -A server1 from there ssh -A server2 from there ssh -A server3 and so on.
    – mbeyss
    Feb 22 '18 at 8:44

Simple answer is to add flag -A like this:

ssh -A [user]@[hostname]

  • Which is also mentioned in the other answer ;)
    – MadMike
    Nov 4 at 7:43
  • @MadMike right, but it's hard to find because of length of answer
    – Daniel
    Nov 8 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.