4 ms·
Or even better, use ProxyJump and don’t forward your agent at all :)
by upon_drumhead 3y ago
Or even better, use ProxyJump and don’t forward your agent at all :)
- aarmenaa 3y agoI'm moving towards this for my current workplace. SSH will only be allowed via VPN, only to a bastion, and that bastion will not permit agent forwarding, or really much of anything other than ProxyJump. I'm baffled that agent forwarding is a feature when OpenSSH won't even use a key file if the permissions are wrong.
- lxgr 3y agoAgent forwarding has its uses; not all of them can be replaced by ProxyJump.
- GauntletWizard 3y agoI never need to SSH directly into servers. When I do, I need to be able to clone private git repos. ssh agent forwarding is the right answer.
- sureglymop 3y agoTo go further, use a VPN that uses UDP and only allow that connection after port knocking three randomly chosen ports.
- ThePowerOfFuet 3y agoThis is way overkill when you could simply use Wireguard instead.
- sureglymop 3y agoNot really, its just a few lines in your nftables/iptables rules. And sure, wireguard is great. It's just an underrated trick from decades ago. :)