2 ms·
Can you explain how this could be exploited (assuming that the user does not ignore warnings)?
by kalmi10 10y ago
Can you explain how this could be exploited (assuming that the user does not ignore warnings)?
- e12e 10y agoI'm not sure if it is a big issue without passing in -A to allow forwarding of authentication to a second server beyond the one you're logging in to. In theory you should still be in control of your secret key and the session even if the first server attempts to proxy or steal your private key. Note that your console/tty or shell might be vulnerable to a malicious server in any case. Stuff like: https://m.theregister.co.uk/2016/01/14/openssh_is_wide_open_to_key_theft_thanks_to_roaming_flaw/ https://m.theregister.co.uk/2016/01/14/openssh_is_wide_open_... seem to indicate that a patched ssh client should (no longer) leak private keys without the -A parameter...