3 ms·

OpenSSH 8.9 introduced a restriction feature to mitigate this. https://www.openssh.com/agent-restrict.html https://www.openssh.com/agent-restrict.html

• ithkuil 3y ago
  It works as advertised. It's a bit clunky to use since it applies to the whole ssh agent, so if you only want it to apply to a specific ssh connection you have to spawn a new agent (unless somebody teaches me a better trick). Example scenario: I'm on my laptop and I use ssh-agent with my key stored on a HSM device. I use it many many times every hour to interact with my git servers and jumping to other machines. It's kn my laptop so I don't want to fiddle with further restrictions. I also have to ssh on a remote machine where I would like to restrict agent forwarding to only perform for a selected hosts (mostly so I can git pull from private repos) Can I do this with one agent?