News for hackers. Stuff that matters.

A comment on Remote Code Execution in OpenSSH’s forwarded SSH-agent. Parent comment

Re:Remote Code Execution in OpenSSH’s forwarded SSH-agent by lxgr on Wednesday July 19, 2023 @07:33PM (#36795001)
> d) generate a new private key on foo and use that to access github.

> [...] only takes a moment [...]

Not every org's policy allows adding unaudited ad-hoc SSH keys.

> [...] much, much safer [...]

Definitely not always, if the hosts you store these keys on are not as hardened as you local machine (or a hardware key connected to it).

[ Parent | on HN ]
Re:Remote Code Execution in OpenSSH’s forwarded SSH-agent by gunapologist99 on Thursday July 20, 2023 @12:36PM (#36803052)
> Not every org's policy allows adding unaudited ad-hoc SSH keys.

Then audit them and get them in the process. Agent forwarding is too big of a risk.

> Definitely not always, if the hosts you store these keys on are not as hardened as you local machine (or a hardware key connected to it).

Once you use agent forwarding, the keys are no longer protected on your local machine. (Ironically, this RCE is precisely because of the requirement to whitelist hardware keys!)

[ Parent | on HN ]