3 ms·
It says so right in the man page: "Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for
by Forbo 12y ago
It says so right in the man page:
"Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent."
And it's not like this is buried in the manual. It says this in the section describing `-A`.
- heipei 12y agoSo true. But then again, based on the amount of comments this got both here and on Reddit, it seems like a lot of people were not aware of the danger or, even if aware, had not found a suitable replacement (like ProxyCommand could offer).
- hobarrera 11y agoIndeed. This is far from being news and has been properly documented for many years. I'm amazed at how people get far enough down the man-pages to understand what it does, how to enable it, but stop reading before these warnings.