4 ms·

For those who don't get why this is terrible, imagine if GitHub were compromised and their ssh agent tampered with. When you clone a repo, they could use your f

For those who don't get why this is terrible, imagine if GitHub were compromised and their ssh agent tampered with. When you clone a repo, they could use your forwarded agent to log into your production hosts. That's pretty bad.

javajosh 11y ago
I don't fully understand how this would work - the key being "forwarded agent". My (poor) understanding is that in order for compromised github to get to a host I'm connected to they would somehow need to invoke ssh on my host, somehow. The only way that would not be the case is if ssh maintains an in-memory persistent thing that a) maintains connections to foreign hosts, and b) can somehow be signaled from active connections. If that's true, then a) I didn't realize it could do that, and b) it would be quite handy sometimes, although the security implications are rather serious.
- saurik 11y ago
  Well, what you describe (pretty much) is the "agent", and many people do, in fact, find it "quite handy" ;P. (I do not use this feature, myself.)
- deleted 11y ago
  [deleted]
- JoshTriplett 11y ago
  The SSH agent maintains your private keys and provides the necessary responses to ssh when it wants to authenticate to a server. If you ssh to a server and forward your SSH agent, that server can then run ssh themselves and impersonate you to a different remote server, and your SSH agent will supply the necessary authentication information. Or, in short: never use ForwardAgent (or ssh -A) to a server you don't trust.
  - javajosh 11y ago
    The remote ssh process asks your host to unencrypt it's traffic? Your process takes an encrypted stream, sends the plaintext, and your keys never leave your machine. That's...incredibly clever, although I can only think of one scenario where it would be necessary (navigating securely through a sequence of ssh sessions where some of the secondary hosts are inaccessible from your originating host. E.g. a kind of "secure trojan horse". Sometimes I feel just so awed at the ingenuity of people, especially with software and computers.
    - throwaway2048 11y ago
      its very useful for so called "Bastion Hosts", an SSH server that allows further access into the network and is totally locked down.
      - laumars 11y ago
        This is what I do for my home network. I hadn't realised it had a name (though not at all surprised)
      - creshal 11y ago
        You don't need agent forwarding for that. Just use ssh's dumb tcp forwarding and keep your agent on your local host. Ex.: Host bastion.company ProxyCommand none Host *.company ProxyCommand ssh -W %h:%p bastion.company
        mentat 11y ago
        Because enabling tcp forwarding is so much more safe on a jump box? That's just asking for another pile of unauditable trouble.
        creshal 11y ago
        Safer than dumping all your private keys onto the jump box and using that to validate the final target? Why yes. This way, your local ssh client validates the final target public key, not the jump box.

javajosh 11y ago

I don't fully understand how this would work - the key being "forwarded agent". My (poor) understanding is that in order for compromised github to get to a host I'm connected to they would somehow need to invoke ssh on my host, somehow. The only way that would not be the case is if ssh maintains an in-memory persistent thing that a) maintains connections to foreign hosts, and b) can somehow be signaled from active connections. If that's true, then a) I didn't realize it could do that, and b) it would be quite handy sometimes, although the security implications are rather serious.

saurik 11y ago
Well, what you describe (pretty much) is the "agent", and many people do, in fact, find it "quite handy" ;P. (I do not use this feature, myself.)
deleted 11y ago
[deleted]
JoshTriplett 11y ago
The SSH agent maintains your private keys and provides the necessary responses to ssh when it wants to authenticate to a server. If you ssh to a server and forward your SSH agent, that server can then run ssh themselves and impersonate you to a different remote server, and your SSH agent will supply the necessary authentication information. Or, in short: never use ForwardAgent (or ssh -A) to a server you don't trust.
- javajosh 11y ago
  The remote ssh process asks your host to unencrypt it's traffic? Your process takes an encrypted stream, sends the plaintext, and your keys never leave your machine. That's...incredibly clever, although I can only think of one scenario where it would be necessary (navigating securely through a sequence of ssh sessions where some of the secondary hosts are inaccessible from your originating host. E.g. a kind of "secure trojan horse". Sometimes I feel just so awed at the ingenuity of people, especially with software and computers.
  - throwaway2048 11y ago
    its very useful for so called "Bastion Hosts", an SSH server that allows further access into the network and is totally locked down.
    - laumars 11y ago
      This is what I do for my home network. I hadn't realised it had a name (though not at all surprised)
    - creshal 11y ago
      You don't need agent forwarding for that. Just use ssh's dumb tcp forwarding and keep your agent on your local host. Ex.: Host bastion.company ProxyCommand none Host *.company ProxyCommand ssh -W %h:%p bastion.company
      - mentat 11y ago
        Because enabling tcp forwarding is so much more safe on a jump box? That's just asking for another pile of unauditable trouble.
        creshal 11y ago
        Safer than dumping all your private keys onto the jump box and using that to validate the final target? Why yes. This way, your local ssh client validates the final target public key, not the jump box.