> Horrified me when I realized all my keys were exposed on any server I hopped into.
For someone only half paying attention, would you mind expanding on what you mean by this?
For someone only half paying attention, would you mind expanding on what you mean by this?
One day, when connecting to a machine over a jump server that utilized SSH forwarding the sysadmin was trying to help me debug something and sent me a list of all of my own keys. It wasn't just a list of the key I was using to connect to that machine but every single key on my laptop, complete with names.
Until he showed me that, I had no idea that the SSH Agent was quite literally sending the house. I was always under the impression that the only thing sent was what was needed to connect to the single machine.
When you have forwarded your agent, these same utilities on the remote hosts are able to the same.
The problem is that remote root users are able to hijack this forwarding.