News for hackers. Stuff that matters.
Re:OpenSSH: client bug CVE-2016-0777 by Xylakant on Thursday January 14, 2016 @01:29PM (#10903311)
which is not very helpful if you for example want to run git via ssh or similar commands on the target server.

There's places where there are two alternatives: agent forwarding or copy the key. Using ssh agent forwarding allows me to use a smart card for the key. It still has it's problems but it's much better than having the key on the remote machine - for example the use of a smartcard mitigates this vulnerability since the key never enters the process memory.

Re:OpenSSH: client bug CVE-2016-0777 by aexaey on Thursday January 14, 2016 @01:56PM (#10903496)
Not sure which exact scenario do you have in mind with ssh+git. ProxyCommand method works just fine for me with my private jumphost in the middle and github on the far end.

Note that for ProxyCommand to work, you don't need a full shell on a jumphost, just "AllowTcpForwarding yes" is enough. On the other hand, with AgentForwarding method you do need a full shell on a jumphost.

Re:OpenSSH: client bug CVE-2016-0777 by Xylakant on Thursday January 14, 2016 @02:03PM (#10903545)
I have a vm that I use as development environment, my laptop is just a dumb terminal. I need to check out code there. It's not a jump host.
Re:OpenSSH: client bug CVE-2016-0777 by aexaey on Thursday January 14, 2016 @02:15PM (#10903639)
If you have clean network path from your terminal to the dev vm, why need for either ProxyCommand or ForwardAgent - just ssh to the vm directly, no?

Of course local, not forwarded ssh-agent on the terminal would be super-handy to avoid typing pass-phrase time and again; but that's different and independent from ForwardAgent.

Re:OpenSSH: client bug CVE-2016-0777 by Xylakant on Thursday January 14, 2016 @02:22PM (#10903713)
I do ssh directly to the VM. It sits behind a VPN connection at aws. I need to make ssh connections from there to github. The key resides on a smartcard in my laptops usb slot. And that's where ssh-agent/ForwardAgent comes into play. I forward my local key to the remote VM.
Re:OpenSSH: client bug CVE-2016-0777 by aexaey on Thursday January 14, 2016 @02:52PM (#10903946)
Fair enough. Makes perfect sense, thanks!