3 ms·
Not GP, but: I do, however when I do this I make sure the certificate is signed with permit-agent-forwarding and demand people just forward their ssh agent on
by rfoo 4y ago
Not GP, but:
I do, however when I do this I make sure the certificate is signed with permit-agent-forwarding and demand people just forward their ssh agent on their laptops.
This also discourages people from leaving their SSH private key on a server just for ssh-ing into other servers in CRON instead of using a proper machine-key.
- the8472 4y agoAgent forwarding has its own security issues, you're exposing all your credentials to the remote. It's better to configure jump hosts in your local ssh config.
- rfoo 4y agoThere's SSH agent restriction now. [1] https://www.openssh.com/agent-restrict.html https://www.openssh.com/agent-restrict.html