3 ms·

Real talk though. How do you manage ssh chaining then? Unique set of keys per user per machine? Short of scp'ing your private key over from your starting box,

Real talk though. How do you manage ssh chaining then? Unique set of keys per user per machine? Short of scp'ing your private key over from your starting box, I can't really think of another way. Then again, if it's not your box, (you don't own the hardware have sole monopoly of root), you probably shouldn't be ssh'ing from it anyway. I've always held there are no true secrets on a computer... Until multi-billion dollar companies decide to collude anyway. Anywho, honest question. I'm a big fan of ssh roaming, never realized that ssh-agent was a thing, but after reading this, if I were to use it, I'd most certainly be doing it witout pkcs11 built in. Shotgunning shared libs for side-effects is absolutely mad. Need to slot that into my source code reading list.

jcotton42 3y ago
Depending on your usecase, ProxyJump may suffice https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump
aidenn0 3y ago
> How do you manage ssh chaining then ProxyJump in the .ssh/config file. If your SSH is too old to support ProxyJump, you should probably upgrade, but this works as well: ProxyCommand ssh -q -W %h:%p jumpost
- salawat 3y ago
  Noted... Guess I know what I'm doing today! Edit: Nevermind, tried it, not sufficient for my use case. I tend to do a lot of mesh-y bouncing around between servers, and -J seems to be more intended for a star/hub&spoke topology. Common ssh priv-key to all machines, or alternatively, a unique set of priv_keys per user per dest machine is about the way to go. You still have privilege escalations to worry about, but thems the breaks. It's a neat trick, I'll give it that.
  - gunapologist99 3y ago
    Just generate a new keypair there on your bounce box then. Don't do -A because this RCE means that not only do you lose your keys, but you lose your laptop, too!
    - lxgr 3y ago
      What if you don’t trust the box enough to store a private key, though?
      - themoonisachees 3y ago
        A box you can't trust to hold your keys could just as easily put a ssh -A command in your bashrc and use your agent to perform stuff on any servers your key is accepted on.
        pritambaral 3y ago
        Not if your agent supports and is configured to confirm each use. See ssh-add -c.
  - aidenn0 3y ago
    It's not limited to star topologies; You can use ProxyJump for any topology that includes fixed routes from a client to a host. Just add a separate host entry for each machine. 4 server example (this assumes your client can connect to only host C) with the following topology: C -> B -> A \-> D ssh configuration snippet: Host A ProxyJump B Host B ProxyJump C Host D ProxyJump C This example is a tree-like topolgy, but you can use host aliases (i.e. add a HostName that is different from the host entry) to define any fixed route to any machine you like.
    - saltcured 3y ago
      For me, the main use of agent-forwarding is that I need to use a command that expects to use SSH to get between leaf nodes. For example git or rsync CLIs that need to manipulate the local filesystem and tunnel their own protocol over SSH to talk to another remote server. At times, I've wished for something like uMatrix but for ssh-agent forwarding, so I could have policies for which peer-to-peer authentications should be allowed for which keys and whether these specific uses should require interactive confirmation.
      - aidenn0 3y ago
        I now have a design in my head for something like that using ssh certificates. Since I have zero use for such a thing I would probably build it wrongly though.

jcotton42 3y ago

Depending on your usecase, ProxyJump may suffice https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump

aidenn0 3y ago

> How do you manage ssh chaining then ProxyJump in the .ssh/config file. If your SSH is too old to support ProxyJump, you should probably upgrade, but this works as well: ProxyCommand ssh -q -W %h:%p jumpost

salawat 3y ago
Noted... Guess I know what I'm doing today! Edit: Nevermind, tried it, not sufficient for my use case. I tend to do a lot of mesh-y bouncing around between servers, and -J seems to be more intended for a star/hub&spoke topology. Common ssh priv-key to all machines, or alternatively, a unique set of priv_keys per user per dest machine is about the way to go. You still have privilege escalations to worry about, but thems the breaks. It's a neat trick, I'll give it that.
- gunapologist99 3y ago
  Just generate a new keypair there on your bounce box then. Don't do -A because this RCE means that not only do you lose your keys, but you lose your laptop, too!
  - lxgr 3y ago
    What if you don’t trust the box enough to store a private key, though?
    - themoonisachees 3y ago
      A box you can't trust to hold your keys could just as easily put a ssh -A command in your bashrc and use your agent to perform stuff on any servers your key is accepted on.
      - pritambaral 3y ago
        Not if your agent supports and is configured to confirm each use. See ssh-add -c.
- aidenn0 3y ago
  It's not limited to star topologies; You can use ProxyJump for any topology that includes fixed routes from a client to a host. Just add a separate host entry for each machine. 4 server example (this assumes your client can connect to only host C) with the following topology: C -> B -> A \-> D ssh configuration snippet: Host A ProxyJump B Host B ProxyJump C Host D ProxyJump C This example is a tree-like topolgy, but you can use host aliases (i.e. add a HostName that is different from the host entry) to define any fixed route to any machine you like.
  - saltcured 3y ago
    For me, the main use of agent-forwarding is that I need to use a command that expects to use SSH to get between leaf nodes. For example git or rsync CLIs that need to manipulate the local filesystem and tunnel their own protocol over SSH to talk to another remote server. At times, I've wished for something like uMatrix but for ssh-agent forwarding, so I could have policies for which peer-to-peer authentications should be allowed for which keys and whether these specific uses should require interactive confirmation.
    - aidenn0 3y ago
      I now have a design in my head for something like that using ssh certificates. Since I have zero use for such a thing I would probably build it wrongly though.