Saturday, July 9, 2022

[SOLVED] How to disable ssh-agent forwarding

Issue

ssh-agent forwarding can be accomplished with ssh -A ....

Most references I have found state that the local machine must configure ~/.ssh/config to enable AgentForwarding with the following code:

Host <trusted_ip>
  ForwardAgent yes

Host *
  ForwardAgent no

However, with this configuration, I am still able to see my local machines keys when tunneling into a remote machine, with ssh -A user@remote_not_trusted_ip, and running ssh-add -l.

From the configuration presented above, I would expect that the ssh-agent forwarding would fail and the keys of the local machine would not be listed by ssh-add -l.

Why is the machine @remote_not_trusted_ip able to access the ssh-agent forwarded keys even though the ~/.ssh/config file states the following?

Host *
  ForwardAgent no

How can i prevent ssh-agent from forwarding keys to machines not explicitly defined in the ~/.ssh/config?


Solution

How can i prevent ssh-agent from forwarding keys to machines not explicitly defined in the ~/.ssh/config?

It is the default behavior. If you do not allow it in ~/.ssh/config it will not be forwarded. But the command-line arguments have higher priority so it overwrites what is defined in the configuration,as explained in the manual page for ssh_config:

ssh(1) obtains configuration data from the following sources in the following order:

  1. command-line options
  2. user's configuration file (~/.ssh/config)
  3. system-wide configuration file (/etc/ssh/ssh_config)

So as already said, you just need to provide correct arguments to ssh.

So back to the questions:

Why is the machine @remote_not_trusted_ip able to access the ssh-agent forwarded keys even though the ~/.ssh/config file states the following?

Host *
  ForwardAgent no

Because the command-line argument -A has higher priority than the configuration files.

How can I prevent ssh-agent from forwarding keys to machines not explicitly defined in the ~/.ssh/config?

Do not use -A command-line option if you do not want forward your ssh-agent. Use -a command-line option instead.



Answered By - Jakuje
Answer Checked By - Katrina (WPSolving Volunteer)
at