up vote 1 down vote favorite
share [g+] share [fb]

My SSH tool (SecureCRT) offers a config option to turn on Agent Forwarding for all SSH sessions. That seems to be helpful to prevent forgetting to enable it when required, but I'm wondering if there is any reason not to?

link|improve this question
86% accept rate
1  
If you trust both ends absolutely, then there is no issue. Can you trust both ends? What if you connect to a different server and forget that's enabled? You could have just compromised your private key. – Phoshi Jul 4 '11 at 13:05
i think you just answered the question. I didn´t realize that it would expose the private key. If you make your comment an answer, then I will accept it :) I assume the private key is only exposed during the lifetime of the session? – Jonathan Day Jul 4 '11 at 13:25
1  
@Phoshi: The key itself will not be compromised, it's not allowed by the ssh-agent protocol. However, as long as agent forwarding is active, the key can be used for authenticating. – grawity Jul 4 '11 at 16:35
feedback

1 Answer

up vote 2 down vote accepted

An Illustrated Guide to SSH Agent Forwarding seems to suggest that your key never leaves the local machine agent.

It also states:

This does require the one-time installation of the user's public — not private! — keys on all the target machines, but this setup cost is rapidly recouped by the added productivity provided. Those using public keys with agent forwarding rarely go back.

The main pro and con of this (from that same page)

  • Pro: Exceptional convenience
  • Con: Requires installation of public (not private) keys on all target systems which can be inconvenient to begin with but after the first time is not a problem.

A Symantec page about ssh-agent seems to suggest the same, you have the ssh-agent running locally on your machine then the following applies:

How does the agent forwarding actually work? In short, the agent is running on one machine, and each time you SSH with agent forwarding, the server creates a 'tunnel' back through the SSH connection to the agent so it's available for any further SSH connections.

But as your communications are passed through another host it does rely on you implicitly trusting that intermediate host not to disclose data regarding the onward connection.

Wikipedia states:

On the local system, it is important that the root user is trustworthy, because the root user can, amongst other things, just read the key file directly. On the remote system, if the ssh-agent connection is forwarded, it is also important that the root user is trustworthy, because they can access the agent socket (though not the key).

link|improve this answer
Excellent research and answer, thanks. So, to summarize, there is no downside given that I´d need to install public keys on the remote machines anyway? – Jonathan Day Jul 4 '11 at 22:46
1  
The main downside appears to be that you have to have some level of trust of the intermediate machine not to somehow compromise the onward connection or redirect you elsewhere, but from what I could find the level of trust is not far beyond what you would expect from any other ssh server you connect to. You do have to trust it to be forwarding you to the true host you are jumping to, but from what I can tell you are not really compromising you security as you are not giving away keys or passwords, only a public key. This is why public key encryption is good. – Mokubai Jul 5 '11 at 12:09
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.