3 ms·
> If a root user is able to convince his ssh client to use another user's agent, root can impersonate that user on any remote system which authorizes the victim
by everythingcli 11y ago
> If a root user is able to convince his ssh client to use another user's agent, root can impersonate that user on any remote system which authorizes the victim user's public key.
Yes, root can also simply `su - user` and then do all stuff you do.
But you should also not put YOUR private keys on a system that has a root user who should not have access YOUR keys.
- daurnimator 11y ago(copying from https://news.ycombinator.com/item?id=10943166 https://news.ycombinator.com/item?id=10943166) > The problem with ssh-agent defaults is that someone with root on the server you're SSH'd into can use your SSH private key (which is on your local machine). > ssh-agent is like temporarily uploading your private key to each remote server logged into. That is very different (and much more common) than an attacker having root on your local machine.