6 ms·

A great bit of kit, but totally unusable for me because of a lack of agent fowarding support[1]. :( 1: https://github.com/mobile-shell/mosh/issues/120 https://

• d33 10y ago
  Why would you need agent forwarding? It's a really dangerous feature.
  • jstanley 10y ago
    It's useful in a corporate environment where you have tens to hundreds of machines you need to use, and all of them are trusted. EDIT: "a really dangerous feature" is accurate though. For example if all of the staff have root access on a staging machine, then anybody can steal the ssh-agent of another user on the staging machine, and use it to login as that user on production machines.
    • ajdlinux 10y ago
      It'd be kinda nice if you could wrap it with some minimal level of protection through SELinux or something. Still wouldn't be as secure as switching it off, but at least a malicious insider would have to jump through a couple of hoops to get there.
    • Daviey 10y ago
      A better way of solving it is to resolve the issue i raised: https://github.com/mobile-shell/mosh/issues/285 https://github.com/mobile-shell/mosh/issues/285
    • 4ad 10y ago
      In such an environment you should be using Kerberos. Then you won't need agent forwarding, and you can maintain security. I would argue that in such an environment you really should be using LDAP+Kerberos, but if you think LDAP is too much effort (it really isn't), plain Kerberos is comparatively trivial to administer, and adding Kerberos (unlike LDAP) doesn't really require any significant changes to your environment.
      • brians 10y ago
        Why is Kerberos ticket forwarding better than agent forwarding? Either way, root (or a bad .bashrc) can use your credentials while you're logged in.
        • 4ad 10y ago
          Sorry. You are absolutely right. Long day... I disable Kerberos ticket forwarding here, for this exact same reason. But then you don't have ticket forwarding! I don't know what I was thinking.
      • jstanley 10y ago
        How does LDAP solve the problem? We use LDAP to manage public keys for each user, but they still need to supply a private key at some point.
        • 4ad 10y ago
          I was talking about Kerberos, not LDAP. However, that's still not right, see parallel comment.
    • falcolas 10y ago
      In my opinion, it's much safer to do one of two things - use `-oProxyCommand=ssh <gateway> nc %h %p`, or set up different keys on the gateway host. You risk the security of your SSH key when you use -A.
      • Daviey 10y ago
        Yeah, that is what my response above points to.
  • ajdlinux 10y ago
    Extraordinarily useful on an internal corporate network, especially when you're scp'ing remote->remote and so on.
    • 4ad 10y ago
      Just use kerberos. You don't need LDAP to use Kerberos (although you probably should be using LDAP too). Kerberos without LDAP is trivial to set-up and administer, and it's very non-invasive, so you don't need to do any significant changes to your organization.
  • vacri 10y ago
    ssh'ing through the jumphost when the VPN on it wasn't working properly was a use-case for me. Agent forwarding is fine, as long as you use it judiciously.
• Mic92 10y ago
  I use this patch for some time and it works great for me.