3 ms·

Thank goodness. I’d been trying to figure out a good solution to this for a while. Horrified me when I realized all my keys were exposed on any server I hopped

Thank goodness. I’d been trying to figure out a good solution to this for a while. Horrified me when I realized all my keys were exposed on any server I hopped into.

tailspin2019 5y ago
> Horrified me when I realized all my keys were exposed on any server I hopped into. For someone only half paying attention, would you mind expanding on what you mean by this?
- brightball 5y ago
  I have an Ubuntu laptop that I've used for work for several years. I have SSH keys for a number of different clients on my machine, including some personal projects. One day, when connecting to a machine over a jump server that utilized SSH forwarding the sysadmin was trying to help me debug something and sent me a list of all of my own keys. It wasn't just a list of the key I was using to connect to that machine but every single key on my laptop, complete with names. Until he showed me that, I had no idea that the SSH Agent was quite literally sending the house. I was always under the impression that the only thing sent was what was needed to connect to the single machine.
  - vbernat 5y ago
    You can get what you want by using `ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes` instead of `ssh -A`.
    - brightball 5y ago
      I feel like I tried that but it’s been a while since I worked on it.
- chasil 5y ago
  Your local agent allows you to use ssh, scp, and sftp without a password. When you have forwarded your agent, these same utilities on the remote hosts are able to the same. The problem is that remote root users are able to hijack this forwarding.
Andys 5y ago
But.. public keys are public? Its not sending your private keys to anyone.
- jasonjayr 5y ago
  Right; but with agent forwarding, an 'evil' process on the target machine, that has privileges to connect to your agent socket (ie, root, or another pid as uid), can ask your agent to sign anything. Your key doesn't get exposed, but the agent will cheerfully sign requests no matter where they are going or where they came from. So, say a virus, or a worm or something just went through your ~/.ssh/config file, your ~/.bash_history and/or your ~/.ssh/known_hosts (if you arn't using host name hashing) -- they could attempt to connect to all your previous hosts with your agent connection, and usually the agent won't offer any clue that this is ongoing ...

Thank goodness. I’d been trying to figure out a good solution to this for a while. Horrified me when I realized all my keys were exposed on any server I hopped into.

tailspin2019 5y ago

> Horrified me when I realized all my keys were exposed on any server I hopped into. For someone only half paying attention, would you mind expanding on what you mean by this?

brightball 5y ago
I have an Ubuntu laptop that I've used for work for several years. I have SSH keys for a number of different clients on my machine, including some personal projects. One day, when connecting to a machine over a jump server that utilized SSH forwarding the sysadmin was trying to help me debug something and sent me a list of all of my own keys. It wasn't just a list of the key I was using to connect to that machine but every single key on my laptop, complete with names. Until he showed me that, I had no idea that the SSH Agent was quite literally sending the house. I was always under the impression that the only thing sent was what was needed to connect to the single machine.
- vbernat 5y ago
  You can get what you want by using `ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes` instead of `ssh -A`.
  - brightball 5y ago
    I feel like I tried that but it’s been a while since I worked on it.
chasil 5y ago
Your local agent allows you to use ssh, scp, and sftp without a password. When you have forwarded your agent, these same utilities on the remote hosts are able to the same. The problem is that remote root users are able to hijack this forwarding.

Andys 5y ago

But.. public keys are public? Its not sending your private keys to anyone.

jasonjayr 5y ago
Right; but with agent forwarding, an 'evil' process on the target machine, that has privileges to connect to your agent socket (ie, root, or another pid as uid), can ask your agent to sign anything. Your key doesn't get exposed, but the agent will cheerfully sign requests no matter where they are going or where they came from. So, say a virus, or a worm or something just went through your ~/.ssh/config file, your ~/.bash_history and/or your ~/.ssh/known_hosts (if you arn't using host name hashing) -- they could attempt to connect to all your previous hosts with your agent connection, and usually the agent won't offer any clue that this is ongoing ...