How to disable ssh-agent forwarding

user_3068233 0
Viewed 16281

ssh-agent forwarding can be accomplished with ssh -A ....

Most references I have found state that the local machine must configure ~/.ssh/config to enable AgentForwarding with the following code:

Host <trusted_ip>
  ForwardAgent yes

Host *
  ForwardAgent no

However, with this configuration, I am still able to see my local machines keys when tunneling into a remote machine, with ssh -A user@remote_not_trusted_ip, and running ssh-add -l.

From the configuration presented above, I would expect that the ssh-agent forwarding would fail and the keys of the local machine would not be listed by ssh-add -l.

Why is the machine @remote_not_trusted_ip able to access the ssh-agent forwarded keys even though the ~/.ssh/config file states the following?

Host *
  ForwardAgent no

How can i prevent ssh-agent from forwarding keys to machines not explicitly defined in the ~/.ssh/config?

ssh linux
5 Answers

This is over a year old, but I encountered the same issue and landed on a config option that works.

I had a problem when I connected from my home computer to my work computer that Git commands no longer worked. I figured out that it was because the connecting home computer's public key was forwarded, which was not configured for that GitHub account.

The -a command line options fixed the problem by not forwarding the authentication agent connection. I also thought that the equivalent ~/.ssh/config option would be this:

ForwardAgent no

When that didn't work I looked for other configuration variables, and finally found that this one worked.

IdentityAgent none
user_11957650

This part of the man-page is crucial:

Since the first obtained value for each parameter is used, more host-specific declarations should be given near the beginning of the file, and general defaults at the end.

Put your Host * with ForwardAgent yes at the end and the specific Host with ForwardAgent, not at the start of the .ssh/config

user_174982210

Not an answer to the question, and maybe just semantics:

Why is the machine @remote_not_trusted_ip able to access the ssh-agent forwarded keys even though the ~/.ssh/config file states the following?

My understanding is that authentication keys are never "forwarded" to a remote computer. Rather ssh-agent forwards authentication challenges from a remote server back to the computer that holds the authentication private key through whatever chain of remote computers the ssh connection is running through.

user_47401030
Related