4 ms·
In our team, we always use an ssh-agent, and require it to confirm, via popup, each use: https://en.wikipedia.org/wiki/Ssh-agent#Security_issues https://en.wik
by hhii 7y ago
In our team, we always use an ssh-agent, and require it to confirm, via popup, each use:
https://en.wikipedia.org/wiki/Ssh-agent#Security_issues https://en.wikipedia.org/wiki/Ssh-agent#Security_issues
> There is a procedure that may prevent malware from using
the ssh-agent socket. If the ssh-add -c option is set when the keys are imported into the ssh-agent, then the agent requests a confirmation from the user using the program specified by the SSH_ASKPASS environment variable, whenever ssh tries to connect.
- __david__ 7y agoI don’t believe ssh multiplexing talks to the ssh agent. That’s the whole point, really. You just connect through an already authorized ssh connection. This eliminates the initial key handshake stuff at the beginning and makes subsequent ssh and scp connections really fast. If I’m correct, your mitigation doesn’t affect this particular kind of attack.
- Piskvorrr 7y agoYou are correct. SSH multiplexing sockets use no authentication whatsoever: the assumption is "if it's up, the user already did that before."