5 ms·

dont people authenticate indiviually using their own credentials on a common bastion host? that seems quite odd to me and like the actual issue here. if you got

• Piskvorrr 7y ago
  Not all credentials are name+password (in fact, using password over SSH is the least secure option available): user authenticates using their name+ssh key. Nothing too useful can be captured from that set of credentials, except to confirm their identity. If they also use an U2F, there's no way to capture that: "I am user Piskvorrr...but have no way to prove it." OTOH, this method captures their session, in other words, "I am user Piskvorrr and I have already proven it by successfully authenticating".