3 ms·

That's baby+bathwater. Just use ssh-add -c to have the ssh-agent confirm every use of a key.

bananskalhalk 2y ago
TIL. Thanks! Gonna do wonders when working at places where I can't use a hardware key with physical confirmation of use. My assessment still stands. Use proxyjump (-J) instead of proxy command whenever possible.
- tichiian 2y ago
  What can also help is specifying the right options right in ~/.ssh/config for certain hosts and domains: E.g. do "ForwardAgent no" globally, use a "Match *.my-trustworthy-company-domain.com" block and add "ForwardAgent yes" there. Also very good for other options that are useful but problematic when used with untrustworthy target hosts, like ForwardX11, GSSAPIAuthentication, weaker *Algorithms (e.g. for those old Cisco boxes with no updates and similar crap). Another neat trick is just using a ""Match *.my-trustworthy-company-domain.com" block" with an "IdentityFile ~/.ssh/secret-company-internal-key" directive. That key will then be used for those company-internal things, but not for any others, if you don't add it to the agent.
- yjftsjthsd-h 2y ago
  Whenever possible, yes, but AIUI it's not always possible; the one use case for which I believe full-on forwarding is required is using your personal credentials to transfer data between two remote servers (ex. rsync directly between servers). If there's a way to do that I would actually much appreciate somebody telling me, but I have looked and not found a way.
deeblering4 2y ago
[flagged]
- tichiian 2y ago
  Sorry, English is not my native language. I know I sometimes sound strange because most of my use of the language is around the internet and at work, not that much casual "normal" conversation.
  - bee_rider 2y ago
    English is my native language and I have no idea what that person was talking about. Your post is fine.
    - hunter2_ 2y ago
      I think that person was talking about having had 4 out of 5 squares in a line on their bingo card already, and stumbling across "baby+bathwater" earned them bingo. The card is metaphorical though... more of a mental buffer that just overflowed.
      - bee_rider 2y ago
        That makes more sense than my solution. As far as I’m concerned the baby and the bath water is just a normal expression. I thought it was something about the use of “confirm,” haha.
    - hoistbypetard 2y ago
      Mine too, and I think the post is fine also, but I have some idea of what that person was talking about. For a while, in some corporate environments, it was a recurring phenomenon to hear someone dismiss an urge to be cautious by saying "You're throwing out the baby with the bathwater." So I can see where someone might count it toward buzzword bingo. But this post also offered an alternate solution when saying "baby+bathwater", so the bingo caller should refuse to score this one.
  - tomcam 2y ago
    Your English is fine. That person was violating HN rules about snark (“Be kind. Don't be snarky. Converse curiously; don't cross-examine. Edit out swipes.”) Learned that rule the hard way. It’s crucial to the success of HN and I am grateful dang corrected me.
lrvick 2y ago
Or use a hardware backed ssh key you have to tap once for every use, like a Yubikey or Nitrokey.

TIL. Thanks! Gonna do wonders when working at places where I can't use a hardware key with physical confirmation of use. My assessment still stands. Use proxyjump (-J) instead of proxy command whenever possible.

tichiian 2y ago
What can also help is specifying the right options right in ~/.ssh/config for certain hosts and domains: E.g. do "ForwardAgent no" globally, use a "Match *.my-trustworthy-company-domain.com" block and add "ForwardAgent yes" there. Also very good for other options that are useful but problematic when used with untrustworthy target hosts, like ForwardX11, GSSAPIAuthentication, weaker *Algorithms (e.g. for those old Cisco boxes with no updates and similar crap). Another neat trick is just using a ""Match *.my-trustworthy-company-domain.com" block" with an "IdentityFile ~/.ssh/secret-company-internal-key" directive. That key will then be used for those company-internal things, but not for any others, if you don't add it to the agent.
yjftsjthsd-h 2y ago
Whenever possible, yes, but AIUI it's not always possible; the one use case for which I believe full-on forwarding is required is using your personal credentials to transfer data between two remote servers (ex. rsync directly between servers). If there's a way to do that I would actually much appreciate somebody telling me, but I have looked and not found a way.

deeblering4 2y ago

[flagged]

tichiian 2y ago
Sorry, English is not my native language. I know I sometimes sound strange because most of my use of the language is around the internet and at work, not that much casual "normal" conversation.
- bee_rider 2y ago
  English is my native language and I have no idea what that person was talking about. Your post is fine.
  - hunter2_ 2y ago
    I think that person was talking about having had 4 out of 5 squares in a line on their bingo card already, and stumbling across "baby+bathwater" earned them bingo. The card is metaphorical though... more of a mental buffer that just overflowed.
    - bee_rider 2y ago
      That makes more sense than my solution. As far as I’m concerned the baby and the bath water is just a normal expression. I thought it was something about the use of “confirm,” haha.
  - hoistbypetard 2y ago
    Mine too, and I think the post is fine also, but I have some idea of what that person was talking about. For a while, in some corporate environments, it was a recurring phenomenon to hear someone dismiss an urge to be cautious by saying "You're throwing out the baby with the bathwater." So I can see where someone might count it toward buzzword bingo. But this post also offered an alternate solution when saying "baby+bathwater", so the bingo caller should refuse to score this one.
- tomcam 2y ago
  Your English is fine. That person was violating HN rules about snark (“Be kind. Don't be snarky. Converse curiously; don't cross-examine. Edit out swipes.”) Learned that rule the hard way. It’s crucial to the success of HN and I am grateful dang corrected me.

lrvick 2y ago

Or use a hardware backed ssh key you have to tap once for every use, like a Yubikey or Nitrokey.