How can I reverse forward git ssh when my config requires a Yubikey
4
votes
1
answer
127
views
I frequently need to log into a VM that has no direct access to the internet or our source code repo. In the past I have circumvented this with a reverse port forward over ssh but now my problem is that we use Yubikey local hardware tokens and I need to forward the request through my local machine, where I can press the key
In the past, without the Yubikey, this is what I had:
Host bastion
HostName 129.153.206.108
### The Remote Host
Host sredev1
HostName 10.0.1.40
ProxyJump bastion
RemoteForward 7999 foo.mycorp.com:7999
Then, updating my local git as:
get remote set-url main localhost:7999
which allowed
git pull
However, the situation is more complicated and I need similar functionality; I am not particular on the method but I don't want to have syncing processes in place.
My ssh config at the moment is:
Host oci*.private.devops.scmservice.*.oci.oracleiaas.com
User cbongior@bmc_operator_access
IdentityAgent ~/.ssh/scm-agent.sock
PKCS11Provider /usr/local/lib/libykcs11.dylib
Host fsretoolsint-jh-1
Hostname 100.92.7.226
User jumpuser
IdentityFile ~/.ssh/jumpuser.pkey
Host sredev2
Port 22
IdentityFile ~/.ssh/sredev2.key
Hostname 10.196.169.56
ProxyJump fsretoolsint-jh-1
RemoteForward 7999 oci.private.devops.scmservice.us-phoenix-1.oci.oracleiaas.com:22
And, for example, in a given repo I have:
git remote -v
origin ssh://localhost:7999/namespaces/axuxirvibvvo/projects/VERM/repositories/fleetman (fetch)
origin ssh://localhost:7999/namespaces/axuxirvibvvo/projects/VERM/repositories/fleetman (push)
And locally that same repo is:
origin ssh://oci.private.devops.scmservice.us-phoenix-1.oci.oracleiaas.com/namespaces/axuxirvibvvo/projects/VERM/repositories/fleetman (fetch)
origin ssh://oci.private.devops.scmservice.us-phoenix-1.oci.oracleiaas.com/namespaces/axuxirvibvvo/projects/VERM/repositories/fleetman (push)
On my vm this is what I get when I try git pull:
-> % git remote set-url origin ssh://localhost:7999/namespaces/axuxirvibvvo/projects/VERM/repositories/fleetman
cbongior@sredev2 [10:51:44 PM] [~/dev/oracle/fleetman] [main *]
-> % git fetch origin
cbongior@localhost: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Now, I know the local keypair isn't registered - and there is no point. We are setup to use Yubi keys to authenticate and this is where I am stumped.
So, for architectural clarity, the arrangement is:
my laptop with YK -> jump host -> vm
and the tunnel arrangement is:
git server << my laptop << jump host << vm port 7999
I am created a reverse tunnel on the VM directorying traffic on port 7999 to the git server on 22
**Question:**
How can I configure this to forward the ssh request to my local agent?
Asked by Christian Bongiorno
(147 rep)
Apr 9, 2025, 04:41 PM
Last activity: Jul 7, 2025, 07:38 PM
Last activity: Jul 7, 2025, 07:38 PM