News for hackers. Stuff that matters.

A comment on We need better support for SSH host certificates. Parent comment

Re:We need better support for SSH host certificates by rfoo on Monday March 27, 2023 @03:43AM (#35323971)
Not GP, but:

I do, however when I do this I make sure the certificate is signed with permit-agent-forwarding and demand people just forward their ssh agent on their laptops.

This also discourages people from leaving their SSH private key on a server just for ssh-ing into other servers in CRON instead of using a proper machine-key.

[ Parent | on HN ]
Re:We need better support for SSH host certificates by the8472 on Monday March 27, 2023 @09:06AM (#35326193)
Agent forwarding has its own security issues, you're exposing all your credentials to the remote.

It's better to configure jump hosts in your local ssh config.

[ Parent | on HN ]
Re:We need better support for SSH host certificates by rfoo on Tuesday March 28, 2023 @05:42AM (#35338033)
There's SSH agent restriction now.

[1] https://www.openssh.com/agent-restrict.html

[ Parent | on HN ]