4 ms·

Because enabling tcp forwarding is so much more safe on a jump box? That's just asking for another pile of unauditable trouble.

• creshal 11y ago
  Safer than dumping all your private keys onto the jump box and using that to validate the final target? Why yes. This way, your local ssh client validates the final target public key, not the jump box.
  • mentat 11y ago
    The whole point of agent forwarding is that you don't have to place your keys on the jump box. With -c for per use confirmation it seems much more secure.
    • creshal 11y ago
      > The whole point of agent forwarding is that you don't have to place your keys on the jump box. A socket that allows dumping the keys isn't really an improvement. If the box is compromised, agent forwarding can still be abused. > seems much more secure. Emphasis on "seems".