#Aws ssh bastion agent forwarding code
#Aws ssh bastion agent forwarding windows

On macOS, ssh-agent will 'forget' this key, once it gets restarted during reboots.

I followed this blog 'Secure Connect to Linux Instances Running in a Private Amazon VPC' to setup SSH Agent forwarding.

You should never store aws key pair in bastion host. If the command says that no identity is available, you'll need to add your key: ssh-add YOUR-KEY. On my solution I configured SSH Agent forwarding on RDP/bastion host. If you're using PuTTY, setup is quite simple. You can check that your key is visible to ssh-agent by running the following command: ssh-add -L. If you're using Git Bash, the setup is the same as on Linux, but you'll need to manually start ssh-agent when you launch the shell, which you can do with a startup script in. If you're using the Linux Subsystem for Windows, which lets you run bash on Windows, the setup will be the same as on Linux or macOS, since it's fully virtualizing a Linux distro to run the command line.

#Aws ssh bastion agent forwarding windows

Since Windows isn't a Unix operating system, setup will vary depending on how exactly you're running ssh in the first place.

#Aws ssh bastion agent forwarding code

Ssh it worked, you should see your username, and you should be able to push and pull code from a repo without ever putting private keys on the server. If you don't have two servers on hand, the easiest way to test if SSH forwarding is working is to add your public key from your local machine to your Github profile and try to SSH from a remote server: Github doesn't care that your local machine answered the question, it just sees that it's been answered, and lets you connect. Your local machine answers the question and sends the response (which does not include your private key) to the server, which forwards it back to Github. Usually the server would consult its own id_rsa files to answer, but instead it will forward the question to your local machine. It works like this: you ask your remote server to pull some code from Github, and Github says 'who are you?' to the server. This doesn't send your private keys over the internet, not even while they're encrypted it just lets a remote server access your local SSH agent and verify your identity. To solve this problem, you can open your local SSH agent to the remote server, allowing it to act as you while you're connected. You want to use SSH authentication for Github, but you don't want your private keys on that remote server, only on your machine. For example, imagine you're connecting to a remote server, and you want to git pull SSH agent forwarding is like going another layer deeper.