Re:Remote Code Execution in OpenSSH’s forwarded SSH-agent
by lxgr on Wednesday July 19, 2023 @07:37PM
(#36795041)
Please stop calling this the "correct" solution. It might work for you; it's not a general rule or widely accepted best practice.
Generating a key per host is just a different security model than key forwarding, and arguably a worse one if key forwarding is done defensively (i.e. forward a separate key, with only those permissions you would give to a key present on the connected host itself).
Generating a key per host is just a different security model than key forwarding, and arguably a worse one if key forwarding is done defensively (i.e. forward a separate key, with only those permissions you would give to a key present on the connected host itself).