4 ms·

No. The problem with ssh-agent defaults is that someone with root on the server you're SSH'd into can use your SSH private key (which is on your local machine).

No. The problem with ssh-agent defaults is that someone with root on the server you're SSH'd into can use your SSH private key (which is on your local machine). ssh-agent is like temporarily uploading your private key to each remote server logged into.

everythingcli 11y ago
Do you have any material I can read up on to this?
Piskvorrr 11y ago
In the same way, a helicopter is like a hot-air baloon. Except it's mostly not - the comparison is very much misleading. The GP is mixing together SSH agent with agent forwarding, and private keys with key signing by agent. There is last week's CVE-2016-0777, which is a vulnerability that enables the exploit you are describing, but in a properly patched configuration, without agent forwarding (nb: this feature is off by default), this is not the case. Same with connection multiplexing: off by default (for good reasons). In other words, either a) please explain how that would work, or b) please stop spreading FUD.
- Piskvorrr 11y ago
  An illustrated explanation how ssh-agent is not like copying private key anywhere. http://www.unixwiz.net/techtips/ssh-agent-forwarding.html http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
- LinuxBender 11y ago
  ssh multiplexing is ON by default. The default is `MaxSessions 10`. Unless you have `MaxSessions 1` in your config, then you have it enabled in your environment. If you have 2FA and SOC1/SOC2 controls, then technically you are out of compliance.