agent forwarding

[dev72]

Hi,
is it possible to use agent forwarding with sshscript?

[iapyeh]

If you mean "tunnel". Not directly, no function call of sshscript to setup a tunnel. But it could be used to establish the ssh connection (including nested connection) which then could be utilized for building a tunnel on top of it.

Below is an example. Main script is sshscripttunnelexample.py (for it to work, ip addresses and password should be changed)
tunnel.zip

[dev72]

Thank you for this code.
I don't mean tunnel, I mean agent forwarding, so that for example I connect to a remote ssh server and I can make a pull request from a git repository with my own ssh key, avoiding to add a key in the remote machine to be able to access git repo.

I mean this: https://www.howtogeek.com/devops/what-is-ssh-agent-forwarding-and-how-do-you-use-it/

[iapyeh]

I see, It seems to be a kind of authentication while making connection. For current version(2.0.2) It is not supported. Since the paramiko seems to have this capability. I would study it and add it in version 2.0.3. Thanks for your suggestion.

[dev72]

thank you.

[iapyeh]

Hi ,

Maybe "ssh-agent" is not required. Since sshscript could assign the key for building ssh connection.
You could try the next example without "ssh-agent"

import sshscript
import os,paramiko
s = sshscript.SSHScriptSession()

keypassword='12345678'
pkey_path='/Users/iap/.ssh/id_ed25519_github'

pkey=paramiko.Ed25519Key.from_private_key_file(pkey_path,keypassword) 
## or, if it is a RSA key
#pkey=paramiko.RSAKey.from_private_key_file(pkey_path,keypassword)

## connecting to github
## Suppose that you have installed the public key to github
with s.connect('[email protected]',pkey=pkey) as host:
    ## execute command
    host('show branch') ## this is a bad command,  please replace it with some workable command
    print(host.stdout)
    print(host.stderr)

## connecting to host1, then host2. 
## suppose local key has installed to host2 by "ProxyJump", like below:
## ssh-copy-id  -i /Users/iap/.ssh/id_ed25519_github -o ProxyJump=user@host1 user@host2
with s.connect('user@host1',pkey=pkey) as host1:
    with host1.commect('user@host2',pkey=pkey) as host2:
        ## execute command
        host2('hostname')
        print('hostname=%s' % host.stdout)

[iapyeh]

If you want to use ssh-agent , the example is below

1. suppose that the ssh-agent is running
2. suppose the key "/Users/iap/.ssh/id_ed25519_github" has been added by "ssh-add"
3. run the next example:

## connecting to host1, then host2 with ssh forwarding. 
## suppose local key has installed to host2 by "ProxyJump", like below:
## ssh-copy-id  -i /Users/iap/.ssh/id_ed25519_github -o ProxyJump=user@host1 user@host2
import sshscript
import os,paramiko    
s = sshscript.SSHScriptSession()

pkey1_path='/Users/iap/.ssh/id_rsa'
pkey1=paramiko.RSAKey.from_private_key_file(pkey1_path)
## pkey=pkey1 is not required, if localhost's key also in ssh-agent, eg.
#with s.connect('user@host1") as host1:
with s.connect('user@host1",pkey=pkey1) as host1:
    ## use the host1's channel to do forwarding
    transport = host1._client.get_transport()
    channel = transport.open_session()
    ## Enable agent forwarding
    paramiko.agent.AgentRequestHandler(channel)        
    ##  this time, we don't need to pass the pkey for host2
    with host1.connect('user@host2') as host2:
        host2.exec_command('hostname')
        print('>>host2:%s' % [ host2.stdout])

[iapyeh]

Instead of "ssh-copy-id", you can also copy the public key to remote host with the following script:

## connecting to host1, then host3 and copy the public key on localhost to host3 
import sshscript
import os,paramiko    
s = sshscript.SSHScriptSession()
## assume localhost's key (/Users/iap/.ssh/id_rsa_forwarding) already in ssh-agent
pubkey_path='/Users/iap/.ssh/id_rsa_forwarding.pub'
with s.connect('user@host1") as host1:
    password_of_host3 = '12345678'
    with host1.connect('user@host3',password_of_host3) as host3:
        host3.upload(pkey_path,'/tmp/key.pub')
        ## if you want to add an extra newline at the bottom of /home/user/.ssh/authorized_keys
        #host3("echo  -en '\\\\n' >> /home/user/.ssh/authorized_keys")
        host3('cat /tmp/key.pub >> /home/user/.ssh/authorized_keys')
        host3('rm -f /tmp/key.pub')

Then, the following script would work (suppose ssh-agent is running)

import sshscript
import os,paramiko    
s = sshscript.SSHScriptSession()
with s.connect('user@host1") as host1:
    with host1.connect('user@host3') as host3:
        ## host3('hostname') is alias of "host3.exec_command('hostname')"
        host3('hostname')
        print('>>host3:%s' % [ host3.stdout])