Remote Code Execution in OpenSSH’s forwarded SSH-agent

Re:Remote Code Execution in OpenSSH’s forwarded SSH-agent by slt2021 on Wednesday July 19, 2023 @02:37PM (#36791180)

I use hashi corp's stack: Boundary + Vault for ssh credential injection

https://developer.hashicorp.com/boundary/tutorials/credentia...

it completely replaces the need for bastion hosts and ssh-agent at scale (I'm a hashicorp's paying customer)

[ Parent | on HN ]

Re:Remote Code Execution in OpenSSH’s forwarded SSH-agent by wahern on Wednesday July 19, 2023 @06:03PM (#36794108)

I wrote a macOS app that supports using Vault Transit Engine keys with OpenSSH, as well as GnuPG and PKCS#11. (OpenSSH is supported via both the agent protocol and PKCS#11.) You can even use an Apple T2 (Secure Enclave) key for peer mTLS authentication to the Vault server. https://www.keymux.com/

Using this teams can share an SSH key without exposing the key; nor do you need to configure certificate PKI, use jump hosts, or otherwise change your existing software or workflows.

[ Parent | on HN ]