3 ms·
> Also SSH agent forwarding is the devil. Don't do it. Care to elaborate? First time I hear this.
by 3np 6y ago
> Also SSH agent forwarding is the devil. Don't do it.
Care to elaborate? First time I hear this.
- viraptor 6y agoIf you forward SSH agent, anyone with privileges to your sockets can use the agent. So for example when you log into some production machine, a process waiting on that machine connects to your agent and has access to... everything. (If you're agent caches key password you won't even get notified)
- tomatocracy 6y agoUsing ssh-add -c when adding keys means it asks for user confirmation (but can still cache the passphrase) each time key use is requested. This can mitigate some of the risk here in the absence of other solutions.
- dpifke 6y agoAssuming your local agent silently signs all requests. This attack doesn't work if e.g. your Yubikey is configured to require a physical tap for every authentication.
- marvion 6y agoOthers already explained why. Matrix.orgs postmortem includes a real world exploitation: https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident https://matrix.org/blog/2019/05/08/post-mortem-and-remediati...