3 ms·
Agent forwarding is tremendously useful, but you should not forward your agent to systems you don't control or can't trust. If you do, you risk having your agen
by jackalope 14y ago
Agent forwarding is tremendously useful, but you should not forward your agent to systems you don't control or can't trust. If you do, you risk having your agent hijacked and used to connect to any system where you have public key authentication enabled.
The author implies that you need to enable agent forwarding to do a git pull from GitHub, but that would be incredibly dangerous. This can't possibly be true, can it? If so, you might as well hand them your private key and passphrase.
- viraptor 14y agoYou don't need it. github works just fine without forwarding.
- klj613-- 14y agoyou need agent forwarding to ssh into a server to do a git pull from _that_ server. e.g. a dev vm.
- munificence 14y agoFrom the ssh man page: Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.
- jackalope 14y agoSorry, I didn't mean to suggest that they could obtain the key, just that hijacking the agent was equally dangerous (provided they know where to use it).
- deleted 14y ago[deleted]