How to ssh multiple hops without putting the local

Question

I have a weird setup where I work from my mac, server A and server B. I can login to A directly without having password by adding my RSA keys, and login to B from A directly without using password too.

I sometimes wanted to login directly into server B from my mac, because B is where the production environment is running. I can use ssh with ProxyCommand, but then I have to add my keys into server B, is there any way I can avoid doing this? Because B is an auto managed server, the key is refreshed all the times.

Theoretically, since I can get from my mac to A (without password), and then from A to B (without password), I should be able to get into B directly. But I can't find the proper way of doing this without adding my key on mac into B's authorized_keys. Or is there a way I can automatically add my key during this login chain, because when I try to do that, ssh reports something about man-in-the-middle attack and rejects it.

Answer 1

Using ProxyCommand you don't need to put your key anywhere. All the authentications are initiated from your host, if you use the -W option like this:

ProxyCommand ssh -W %h:%p proxy