3 ms·
In the same way, a helicopter is like a hot-air baloon. Except it's mostly not - the comparison is very much misleading. The GP is mixing together SSH agent wi
by Piskvorrr 11y ago
In the same way, a helicopter is like a hot-air baloon. Except it's mostly not - the comparison is very much misleading.
The GP is mixing together SSH agent with agent forwarding, and private keys with key signing by agent.
There is last week's CVE-2016-0777, which is a vulnerability that enables the exploit you are describing, but in a properly patched configuration, without agent forwarding (nb: this feature is off by default), this is not the case. Same with connection multiplexing: off by default (for good reasons). In other words, either a) please explain how that would work, or b) please stop spreading FUD.
- Piskvorrr 11y agoAn illustrated explanation how ssh-agent is not like copying private key anywhere. http://www.unixwiz.net/techtips/ssh-agent-forwarding.html http://www.unixwiz.net/techtips/ssh-agent-forwarding.html
- LinuxBender 11y agossh multiplexing is ON by default. The default is `MaxSessions 10`. Unless you have `MaxSessions 1` in your config, then you have it enabled in your environment. If you have 2FA and SOC1/SOC2 controls, then technically you are out of compliance.