News for hackers. Stuff that matters.

A comment on Remote Code Execution in OpenSSH’s forwarded SSH-agent. Parent comment

Re:Remote Code Execution in OpenSSH’s forwarded SSH-agent by throwawaaarrgh on Wednesday July 19, 2023 @02:43PM (#36791280)
Make an ssh connection to foo with a port forward. Then make an ssh connection to bar through foo. Keys stay on your machine. I'm pretty sure there's built in features to do this.
[ Parent | on HN ]
Re:Remote Code Execution in OpenSSH’s forwarded SSH-agent by gunapologist99 on Wednesday July 19, 2023 @04:10PM (#36792467)
That won't work for a connection to github that's being initiated from foo.

The best solution in that situation is a separate key that's private to foo.

[ Parent | on HN ]
Re:Remote Code Execution in OpenSSH’s forwarded SSH-agent by lxgr on Wednesday July 19, 2023 @07:34PM (#36795017)
No, the best solution would be partial key forwarding of one or several separate keys only scoped to git access.
[ Parent | on HN ]