4 ms·

SSH Agent forwarding issue >5years old now. :( https://github.com/mobile-shell/mosh/issues/120 https://github.com/mobile-shell/mosh/issues/120

emmelaich 9y ago
To be clear a FeatureRequest not a Bug. So I think the age is understandable.
- st3fan 9y ago
  No, what it shows is that this project is just in maintance mode. There is plenty to be improved, but there is zero momentum. This is hard for open source projects in general. What it needs is not just a happy user base, but also developers and a strong leader wanting to move this into the future. I think specially the latter is missing. I think Mosh was a great thesis project, but stalled after that. It has so much potential. I wish they would push this to the next level and do proper protocol documentation and an IETF proposal like an RFC.
  - tibbetts 9y ago
    I figure this can go along like screen for a long time. I remember in about 1999 I was really annoyed that screen wasn't getting better fast enough and no one wanted my patches. Then I got used to using screen and it was fine. Now the cool kids use tmux or something and I can't be bothered to change, but I am abstractly glad the world is improving. Similarly I expect someone to clone/replace/improve mosh, and for people who demand the best new functionality to eventually head there.
- jitl 9y ago
  A patch for SSH Agent forwarding has existed for 4+ years, and there have been several iterations of PRs to merge that into Mosh. The maintainers don't care enough to merge working code for an oft-requested feature. PRs: Most recent: https://github.com/mobile-shell/mosh/pull/696 https://github.com/mobile-shell/mosh/pull/696 Oldest: https://github.com/mobile-shell/mosh/pull/423 https://github.com/mobile-shell/mosh/pull/423 https://github.com/mobile-shell/mosh/pull/583 https://github.com/mobile-shell/mosh/pull/583
feld 9y ago
Ssh agent forwarding is insecure. Don't use it. https://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-considered-harmful/ https://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-con...
- jiqiren 9y ago
  This link is full of counter arguments the author even concedes. If this is so serious why doesn't openssh team remove the feature? There is no excuse for denying mosh users existing patches/features and the above link changes nothing.
  - feld 9y ago
    X Forwarding and TCP Forwarding is also insecure. Not everyone has the same threat model, but for the average person it's a bad idea to do agent Forwarding unless they fully understand the consequences. This doesn't mean the OpenSSH team should remove it.

emmelaich 9y ago

To be clear a FeatureRequest not a Bug. So I think the age is understandable.

st3fan 9y ago
No, what it shows is that this project is just in maintance mode. There is plenty to be improved, but there is zero momentum. This is hard for open source projects in general. What it needs is not just a happy user base, but also developers and a strong leader wanting to move this into the future. I think specially the latter is missing. I think Mosh was a great thesis project, but stalled after that. It has so much potential. I wish they would push this to the next level and do proper protocol documentation and an IETF proposal like an RFC.
- tibbetts 9y ago
  I figure this can go along like screen for a long time. I remember in about 1999 I was really annoyed that screen wasn't getting better fast enough and no one wanted my patches. Then I got used to using screen and it was fine. Now the cool kids use tmux or something and I can't be bothered to change, but I am abstractly glad the world is improving. Similarly I expect someone to clone/replace/improve mosh, and for people who demand the best new functionality to eventually head there.
jitl 9y ago
A patch for SSH Agent forwarding has existed for 4+ years, and there have been several iterations of PRs to merge that into Mosh. The maintainers don't care enough to merge working code for an oft-requested feature. PRs: Most recent: https://github.com/mobile-shell/mosh/pull/696 https://github.com/mobile-shell/mosh/pull/696 Oldest: https://github.com/mobile-shell/mosh/pull/423 https://github.com/mobile-shell/mosh/pull/423 https://github.com/mobile-shell/mosh/pull/583 https://github.com/mobile-shell/mosh/pull/583

feld 9y ago

Ssh agent forwarding is insecure. Don't use it. https://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-considered-harmful/ https://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-con...

jiqiren 9y ago
This link is full of counter arguments the author even concedes. If this is so serious why doesn't openssh team remove the feature? There is no excuse for denying mosh users existing patches/features and the above link changes nothing.
- feld 9y ago
  X Forwarding and TCP Forwarding is also insecure. Not everyone has the same threat model, but for the average person it's a bad idea to do agent Forwarding unless they fully understand the consequences. This doesn't mean the OpenSSH team should remove it.