9 ms·
> Horrified me when I realized all my keys were exposed on any server I hopped into. For someone only half paying attention, would you mind expanding on what y
by tailspin2019 5y ago
> Horrified me when I realized all my keys were exposed on any server I hopped into.
For someone only half paying attention, would you mind expanding on what you mean by this?
- brightball 5y agoI have an Ubuntu laptop that I've used for work for several years. I have SSH keys for a number of different clients on my machine, including some personal projects. One day, when connecting to a machine over a jump server that utilized SSH forwarding the sysadmin was trying to help me debug something and sent me a list of all of my own keys. It wasn't just a list of the key I was using to connect to that machine but every single key on my laptop, complete with names. Until he showed me that, I had no idea that the SSH Agent was quite literally sending the house. I was always under the impression that the only thing sent was what was needed to connect to the single machine.
- vbernat 5y agoYou can get what you want by using `ssh-agent ssh -o AddKeysToAgent=confirm -o ForwardAgent=yes` instead of `ssh -A`.
- brightball 5y agoI feel like I tried that but it’s been a while since I worked on it.
- chasil 5y agoYour local agent allows you to use ssh, scp, and sftp without a password. When you have forwarded your agent, these same utilities on the remote hosts are able to the same. The problem is that remote root users are able to hijack this forwarding.