4 ms·

its very useful for so called "Bastion Hosts", an SSH server that allows further access into the network and is totally locked down.

by throwaway2048 11y ago

laumars 11y ago
This is what I do for my home network. I hadn't realised it had a name (though not at all surprised)
creshal 11y ago
You don't need agent forwarding for that. Just use ssh's dumb tcp forwarding and keep your agent on your local host. Ex.: Host bastion.company ProxyCommand none Host *.company ProxyCommand ssh -W %h:%p bastion.company
- mentat 11y ago
  Because enabling tcp forwarding is so much more safe on a jump box? That's just asking for another pile of unauditable trouble.
  - creshal 11y ago
    Safer than dumping all your private keys onto the jump box and using that to validate the final target? Why yes. This way, your local ssh client validates the final target public key, not the jump box.
    - mentat 11y ago
      The whole point of agent forwarding is that you don't have to place your keys on the jump box. With -c for per use confirmation it seems much more secure.
      - creshal 11y ago
        > The whole point of agent forwarding is that you don't have to place your keys on the jump box. A socket that allows dumping the keys isn't really an improvement. If the box is compromised, agent forwarding can still be abused. > seems much more secure. Emphasis on "seems".
beagle3 11y ago
I know it as a "jump host" or "jump box". Regardless, it's still not a good idea to have agent forwarding - what about the boxes you forward to? Do you trust them not to abuse the forwarding trust (Is there a way to limit forwarding trust to just one machine?) Also, I used to add every jump combination into my .ssh/config file, but came across a wonderful trick that makes it unnecessary: https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Recursively_chaining_gateways https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_J...

its very useful for so called "Bastion Hosts", an SSH server that allows further access into the network and is totally locked down.

laumars 11y ago

This is what I do for my home network. I hadn't realised it had a name (though not at all surprised)

creshal 11y ago

You don't need agent forwarding for that. Just use ssh's dumb tcp forwarding and keep your agent on your local host. Ex.: Host bastion.company ProxyCommand none Host *.company ProxyCommand ssh -W %h:%p bastion.company

mentat 11y ago
Because enabling tcp forwarding is so much more safe on a jump box? That's just asking for another pile of unauditable trouble.
- creshal 11y ago
  Safer than dumping all your private keys onto the jump box and using that to validate the final target? Why yes. This way, your local ssh client validates the final target public key, not the jump box.
  - mentat 11y ago
    The whole point of agent forwarding is that you don't have to place your keys on the jump box. With -c for per use confirmation it seems much more secure.
    - creshal 11y ago
      > The whole point of agent forwarding is that you don't have to place your keys on the jump box. A socket that allows dumping the keys isn't really an improvement. If the box is compromised, agent forwarding can still be abused. > seems much more secure. Emphasis on "seems".

beagle3 11y ago

I know it as a "jump host" or "jump box". Regardless, it's still not a good idea to have agent forwarding - what about the boxes you forward to? Do you trust them not to abuse the forwarding trust (Is there a way to limit forwarding trust to just one machine?) Also, I used to add every jump combination into my .ssh/config file, but came across a wonderful trick that makes it unnecessary: https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts#Recursively_chaining_gateways https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_J...