Bypassing Authentication on SSH Bastion Hosts

Re:Bypassing Authentication on SSH Bastion Hosts by hhii on Wednesday November 13, 2019 @12:22AM (#21521358)

In our team, we always use an ssh-agent, and require it to confirm, via popup, each use:

https://en.wikipedia.org/wiki/Ssh-agent#Security_issues

> There is a procedure that may prevent malware from using the ssh-agent socket. If the ssh-add -c option is set when the keys are imported into the ssh-agent, then the agent requests a confirmation from the user using the program specified by the SSH_ASKPASS environment variable, whenever ssh tries to connect.

[ Parent | on HN ]

Re:Bypassing Authentication on SSH Bastion Hosts by __david__ on Wednesday November 13, 2019 @01:16AM (#21521556)

I don’t believe ssh multiplexing talks to the ssh agent. That’s the whole point, really. You just connect through an already authorized ssh connection. This eliminates the initial key handshake stuff at the beginning and makes subsequent ssh and scp connections really fast.

If I’m correct, your mitigation doesn’t affect this particular kind of attack.

[ Parent | on HN ]

Re:Bypassing Authentication on SSH Bastion Hosts by Piskvorrr on Wednesday November 13, 2019 @05:19AM (#21522604)

You are correct. SSH multiplexing sockets use no authentication whatsoever: the assumption is "if it's up, the user already did that before."

[ Parent | on HN ]