Unit 4: Users and groups · Lesson 6 of 7 · 16 min

SSH agent forwarding

Forwarding lends your keys to every server you visit. Find where it is on and replace it with a jump host.

mission

You are
You are reviewing how developers reach web01.
Situation
riya's SSH config forwards her agent everywhere. While she is connected, root on that server can use her keys to reach anything else her keys open.
Goal
See which hosts get her agent and what web01 itself allows.
Hand in
A config change for developers and one for the server.

What forwarding lends

  1. LaptopThe agent holds riya's key
  2. web01Root here can talk to her agent through the socket
  3. db01Reached with her key, without her knowing
01

Resolve the config for one host

ssh -G prints the final settings for a host without connecting.

learner@root-lab
ssh -G -F home/riya/.ssh/config web01 | grep -E '^(hostname|user|forwardagent) '
user riya
hostname 10.20.0.11
forwardagent yes

you should see forwardagent yes for web01.

02

And for any other host

learner@root-lab
ssh -G -F home/riya/.ssh/config db01 | grep -E '^forwardagent '
forwardagent yes

you should see Also yes, because the rule is under Host *.

03

Check the server side

learner@root-lab
grep -Ei '^(AllowAgentForwarding|AllowTcpForwarding)' /etc/ssh/sshd_config /srv/baseline/sshd_config.hardened
/etc/ssh/sshd_config:AllowTcpForwarding yes
/srv/baseline/sshd_config.hardened:AllowTcpForwarding no

you should see web01 allows TCP forwarding today. The hardened baseline turns it off.

Reaching db01 through web01

Forward the agent
Host *
    ForwardAgent yes

ssh web01, then ssh db01

Keys usable by anyone with root on web01

Jump through it
Host db01
    ProxyJump web01

ssh db01

Encrypted end to end, keys never leave the laptop

What a defender takes away

  1. 1ForwardAgent yes under Host * is a finding.
  2. 2ProxyJump reaches inner hosts without lending keys.
  3. 3ssh -G shows the settings that will really apply.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.