5 ms·

>Setup and use ssh-agent. They make the life so easy. My #1 ssh usability tip: put this into ~/.ssh/config: AddKeysToAgent yes It'll automatically add ke

>Setup and use ssh-agent. They make the life so easy. My #1 ssh usability tip: put this into ~/.ssh/config: AddKeysToAgent yes It'll automatically add keys to your agent the first time you use them during a session, so you don't need a separate step for adding keys every time you log in.

res0nat0r 7y ago
I've not noticed this option before, so will this replace keychain? I install this on every new laptop I use so I essentially only have to enter my ssh-agent password for the key once per reboot, and every bash shell hooks into it automatically. https://www.funtoo.org/Keychain https://www.funtoo.org/Keychain
Lammy 7y ago
Be careful; there are plenty of ways ssh-agent can bite you too. Here are a few: http://rabexc.org/posts/pitfalls-of-ssh-agents http://rabexc.org/posts/pitfalls-of-ssh-agents
- ddevault 7y ago
  This article can be boiled down to one common sense idea and one less obvious idea: 1. Don't put secret information on a machine where someone you don't trust has root. 2. Don't use agent forwarding unless you know you can trust the machine on the other end. Since agent forwarding is not enabled by default, both of these seem pretty obvious to me.
  - dx87 7y ago
    It's still good info, I don't think it's obvious to most people. I was doing a pentest for a Fortune 500 company, and a key component of us compromising their entire network was a bastion host that controlled access to sensitive parts of their network. Turns out whoever controlled the machine made the rookie mistake of running a cron job as root that ran a non root-owned script, which enabled us to elevate and copy the ssh keys of a lot of IT staff.
    - ddevault 7y ago
      Good insight. You should definitely be careful with forwarding.
      - jlgaddis 7y ago
        Yes, be careful when using ForwardAgent and, more importantly, avoid using it altogether unless you absolutely need to! Most "use cases" I've come across could have been solved "better" by simply using ProxyCommand instead. That was apparently too hard, though, so use of agent forwarding continued. Since the introduction of ProxyJump a while back, however, it's now even easier to avoid using agent forwarding in most -- but not all -- cases. So yes, be careful when using agent forwarding but, more importantly, as much as possible, just avoid using it entirely unless you absolutely must!
        manuel_w 7y ago
        Sometimes I log into a machine and would like to ssh-clone a git repository there using the private key I've got on my local machine. Is there a way around forwarding my ssh-agent in this case?
    - kitotik 7y ago
      IIRC this is how the matrix.org infrastructure compromise happened.
  - staticassertion 7y ago
    > Don't use agent forwarding unless you know you can trust the machine on the other end. On both ends. Agent hijacking can happen on client or server, with an attacker present. And is there any machine you can 'trust' ? That's a big ask, and I think the modern 'zero trust' is fundamentally averse to the concept.
  - shandor 7y ago
    > 2. Don't use agent forwarding unless you know you can trust the machine on the other end. This gets said a lot, but doesn't forcing a prompt every time the forwarded key gets used mitigate this? SSH is not like surfing on the web with traffic flowing everywhere all the time. If you did not just now run any commands that are expected to invoke SSH, you probably don't want to answer yes to that prompt.
inetknght 7y ago
> It'll automatically add keys to your agent the first time you use them during a session If you have more than one private key in your agent, then SSH will try each one sequentially. That can lead to mistakenly getting banned by monitoring software for what can appear indistinguishable to be an authentication attack. Not to mention the wrongness of presenting "any and all keys" to any host you connect to. If you have multiple keys in your agent, you _really_ should manually configure what key to present using `-i` or `IdentityFile`. But you should also use `IdentitiesOnly` too.
- krferriter 7y ago
  I don't understand what `IdentitiesOnly` does. If I have `IdentityFile`s defined for hosts in ssh_config, doesn't that already accomplish what this does? Can you explain what situation `IdentitiesOnly` covers that is different from `IdentityFile`?
  - webvictim 7y ago
    Author here. If you specify an IdentityFile then that’ll be tried first (as an explicit identity) but if that doesn’t work then by default, ssh-agent identities will be tried sequentially afterwards. IdentitiesOnly suppresses that behaviour.
- shawnz 7y ago
  > If you have multiple keys in your agent, you _really_ should manually configure what key to present using `-i` or `IdentityFile`. If you specify -i or IdentityFile, the agent isn't used at all. You will have to type the keyfile password even if the key is in the agent, therefore making the agent useless. This "feature" has been a big annoyance for me, since I like to use different keys per machine.
  - kadoban 7y ago
    There's no way that's true. I just checked and I have that option set on many of my ssh aliases, and ssh-agent functions exactly as expected. Maybe it depends on version or something? I've had the same config for years though over several very different OSes and presumably versions of everything.
keeperofdakeys 7y ago
I'd recommend you try "AddKeysToAgent confirm", then you'll get a prompt to approve the key usage each time its used. (Can be annoying for usage with automation like ansible). Having a forwarded agent was how matrix recently got hacked, confirmation is a decent work around if you need to forward your agent.

res0nat0r 7y ago

I've not noticed this option before, so will this replace keychain? I install this on every new laptop I use so I essentially only have to enter my ssh-agent password for the key once per reboot, and every bash shell hooks into it automatically. https://www.funtoo.org/Keychain https://www.funtoo.org/Keychain

Lammy 7y ago

Be careful; there are plenty of ways ssh-agent can bite you too. Here are a few: http://rabexc.org/posts/pitfalls-of-ssh-agents http://rabexc.org/posts/pitfalls-of-ssh-agents

ddevault 7y ago
This article can be boiled down to one common sense idea and one less obvious idea: 1. Don't put secret information on a machine where someone you don't trust has root. 2. Don't use agent forwarding unless you know you can trust the machine on the other end. Since agent forwarding is not enabled by default, both of these seem pretty obvious to me.
- dx87 7y ago
  It's still good info, I don't think it's obvious to most people. I was doing a pentest for a Fortune 500 company, and a key component of us compromising their entire network was a bastion host that controlled access to sensitive parts of their network. Turns out whoever controlled the machine made the rookie mistake of running a cron job as root that ran a non root-owned script, which enabled us to elevate and copy the ssh keys of a lot of IT staff.
  - ddevault 7y ago
    Good insight. You should definitely be careful with forwarding.
    - jlgaddis 7y ago
      Yes, be careful when using ForwardAgent and, more importantly, avoid using it altogether unless you absolutely need to! Most "use cases" I've come across could have been solved "better" by simply using ProxyCommand instead. That was apparently too hard, though, so use of agent forwarding continued. Since the introduction of ProxyJump a while back, however, it's now even easier to avoid using agent forwarding in most -- but not all -- cases. So yes, be careful when using agent forwarding but, more importantly, as much as possible, just avoid using it entirely unless you absolutely must!
      - manuel_w 7y ago
        Sometimes I log into a machine and would like to ssh-clone a git repository there using the private key I've got on my local machine. Is there a way around forwarding my ssh-agent in this case?
  - kitotik 7y ago
    IIRC this is how the matrix.org infrastructure compromise happened.
- staticassertion 7y ago
  > Don't use agent forwarding unless you know you can trust the machine on the other end. On both ends. Agent hijacking can happen on client or server, with an attacker present. And is there any machine you can 'trust' ? That's a big ask, and I think the modern 'zero trust' is fundamentally averse to the concept.
- shandor 7y ago
  > 2. Don't use agent forwarding unless you know you can trust the machine on the other end. This gets said a lot, but doesn't forcing a prompt every time the forwarded key gets used mitigate this? SSH is not like surfing on the web with traffic flowing everywhere all the time. If you did not just now run any commands that are expected to invoke SSH, you probably don't want to answer yes to that prompt.

inetknght 7y ago

> It'll automatically add keys to your agent the first time you use them during a session If you have more than one private key in your agent, then SSH will try each one sequentially. That can lead to mistakenly getting banned by monitoring software for what can appear indistinguishable to be an authentication attack. Not to mention the wrongness of presenting "any and all keys" to any host you connect to. If you have multiple keys in your agent, you _really_ should manually configure what key to present using `-i` or `IdentityFile`. But you should also use `IdentitiesOnly` too.

krferriter 7y ago
I don't understand what `IdentitiesOnly` does. If I have `IdentityFile`s defined for hosts in ssh_config, doesn't that already accomplish what this does? Can you explain what situation `IdentitiesOnly` covers that is different from `IdentityFile`?
- webvictim 7y ago
  Author here. If you specify an IdentityFile then that’ll be tried first (as an explicit identity) but if that doesn’t work then by default, ssh-agent identities will be tried sequentially afterwards. IdentitiesOnly suppresses that behaviour.
shawnz 7y ago
> If you have multiple keys in your agent, you _really_ should manually configure what key to present using `-i` or `IdentityFile`. If you specify -i or IdentityFile, the agent isn't used at all. You will have to type the keyfile password even if the key is in the agent, therefore making the agent useless. This "feature" has been a big annoyance for me, since I like to use different keys per machine.
- kadoban 7y ago
  There's no way that's true. I just checked and I have that option set on many of my ssh aliases, and ssh-agent functions exactly as expected. Maybe it depends on version or something? I've had the same config for years though over several very different OSes and presumably versions of everything.

keeperofdakeys 7y ago

I'd recommend you try "AddKeysToAgent confirm", then you'll get a prompt to approve the key usage each time its used. (Can be annoying for usage with automation like ansible). Having a forwarded agent was how matrix recently got hacked, confirmation is a decent work around if you need to forward your agent.