3 ms·
It is possible to require confirmation before `ssh-add` allows to use a key. From `man ssh-add`: -c Indicates that added identities should be subject
by TimWolla 6y ago
It is possible to require confirmation before `ssh-add` allows to use a key. From `man ssh-add`:
-c Indicates that added identities should be subject to confirmation
before being used for authentication. Confirmation is performed
by ssh-askpass(1). Successful confirmation is signaled by a zero
exit status from ssh-askpass(1), rather than text entered into
the requester.
- jamiesonbecker 6y agoThis slightly reduces risk, but it's inconvenient and probably better to just use agent forwarding as little as possible.
- yencabulator 6y agoThe stupidest thing is that `-c` gives you no information about what you're approving. All an attacker needs to do is race an actual ssh call, and you'll happily okay it.