Re: ssh-agent leapfrog

From: Jorey Bump (devnull@joreybump.com)
Date: 02/03/02 

From: Jorey Bump <devnull@joreybump.com>
Date: Sun, 03 Feb 2002 21:40:25 GMT

Michael Heiming wrote:

> Jorey Bump(devnull@joreybump.com -
> <nDh78.14205$0V6.4051@nwrddc02.gnilink.net>) wrote at Sunday 03
> February 2002 22:06:
>
>> I just discovered an interesting side effect of using ssh-agent:
>>
>> If I load my key into ssh-agent and connect to a remote account that
>> does NOT have my public key stored in .ssh/authorized_keys2, I can
>> ssh from that account to another account that DOES have the key,
>> without providing any passphrase or password. Apparently, the second
>> account is using my ssh-agent for authentication. Is there any way
>> to prevent this?
>
> Yes, type 'man ssh' and read about ForwardAgent, now edit ssh_config
> to your needs.

Thanks, Michael. Mandrake has it enabled by default in ssh_config. I see I
can override it on a per account basis in .ssh/config.

Relevant Pages

  • Re: Passing password in ssh
    ... If I create keys without a passphrase, and share the public keys between ... You do know that you first have to get the private key of the key ... The .ssh directory also ... But simply cracking into a user's account who has access to several ...
    (Fedora)
  • Re: Problems with Sudo
    ... where only one unprivileged account is allowed to log in. ... you're gaining nothing at all by running two ssh daemons ... Using odd port numbers isn't very useful either, ... I have SSH exposed to the world with key-only login and an iptables ...
    (Ubuntu)
  • Re: ssh and subsequent telnet, encrypted?
    ... >> account of mine only to launch telnet to a newsserver from ... is that telnet session (since it is embedded in the ssh ... the traffic between my shell account and the newsserver is ...
    (comp.security.ssh)
  • RE: Illegal user ssh probes
    ... the attacked account names. ... Subject: Illegal user ssh probes ... On linux the admin account could possibly lead to access on the box. ...
    (SSH)
  • Re: .k5login and non-kerberized ssh client
    ... For example,a website owned by 'wsowner' needs to be ... SSH and SFTP clients. ... access the 'wsowner' account directly. ... So far as I know, other krb5 PAM modules do not support this, which is one ...
    (comp.protocols.kerberos)