Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Before SSH-ing into untrusted hosts, make sure you understand what SSH agent-forwarding and X11-forwarding are.

Also, maybe don't trust the SSH config defaults on whatever host you're on at the moment. You can explicitly set defaults yourself in your `~/.ssh/config` or similar.



> ... make sure you understand ... SSH agent-forwarding ...

And how to configure your ssh agent to confirm with you on each use. See `-c` in `ssh-add(1)`, and make sure you're using an agent that supports it (GNOME's Seahorse doesn't, gpg-agent does, macOS's ssh-agent doesn't make can be made to via some AppleScript).

Because my ssh agent confirms each key use, I enable agent forwarding on every ssh connection without fear.


>SSH agent-forwarding and X11-forwarding

Are they enabled by default when running SSH?


No, disabled by default




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: