The pitfalls of using SSH-agent, or how to use an agent safely

Re:The pitfalls of using SSH-agent, or how to use an agent s... by rfjakob on Saturday September 18, 2021 @12:10PM (#28577269)

From man ssh-add:

     -c      Indicates that added identities should be subject to confirmation be‐
             fore being used for authentication.  Confirmation is performed by
             ssh-askpass(1).  Successful confirmation is signaled by a zero exit
             status from ssh-askpass(1), rather than text entered into the re‐
             quester.

I'm a bit surprised that this is not mention in the article, as this seems very useful to make exploits more difficult.

[ Parent | on HN ]

Re:The pitfalls of using SSH-agent, or how to use an agent s... by metafunctor on Saturday September 18, 2021 @12:56PM (#28577597)

Yep, or put this in your ~/.ssh/config

  AddKeysToAgent confirm

[ Parent | on HN ]

Re:The pitfalls of using SSH-agent, or how to use an agent s... by lathiat on Saturday September 18, 2021 @08:45PM (#28580685)

While helpful it mostly just says “ok to sign” and it’s super easy to accidentally say yes by hitting enter at the wrong time.

I need to look into the original post have wanted this for a while.

[ Parent | on HN ]