Your browser does not allow storing cookies. We recommend enabling them.

SSH Tectia

Disabling Agent Forwarding

By default, when you have an agent running, the agent connection will be forwarded to the server side. This is for convenience, so that a system admin (or a power user) can easily connect from machine to machine.

If the server's administrator is malicious, he can use your agent to sign requests. This will not allow access to the private key, but will cause a security risk, because the malicious admin can then connect with your credentials anywhere where they are accepted.

If you do not trust the server, disable agent forwarding in the ssh-broker-config.xml file (either under default-settings or per each connection profile):

<forwards>
  <forward type="agent" state="off" />
  ...
</forwards>

On the command line, the -a option has the same effect:

$ sshg3 -a host3.example.com

See forwards for more information.


 

 
What to read next:

  • Reduce Secure Shell risk. Get to know the NIST 7966.



    The NISTIR 7966 guideline from the Computer Security Division of NIST is a direct call to action for organizations regardless of industry and is a mandate for the US Federal government.
    Download now
  • ISACA Practitioner Guide for SSH



    With contributions from practitioners, specialists and SSH.COM experts, the ISACA “SSH: Practitioner Considerations” guide is vital best practice from the compliance and audit community.
    Download now