When you execute:
ssh -A -t [email protected]
you are establishing a session between desktop
and bar.com
. From now on, everything you type within this session is interpreted by and executed on bar.com
.
Then you establish a session from bar.com
to server
(sls
is not a standard command, but I assume it is a wrapper for another SSH connection).
You have a second session encrypted between bar.com
and server
. This session is authenticated with your private key which is stored on the desktop
machine.
In the first command you have -A
argument which enables agent forwarding. This mechanism allows encrypting the session between bar.com
and the server, using the desktop
machine (and the private key stored there) for authentication.
It does not mean the second connection is encrypted end-to-end between desktop
and server
, it just means desktop
authorised a session between bar.com
and server
.
The situation cannot be likened to an attack, because you deliberately choose to use the feature for your own convenience and security (your private key does not leave your machine, you don't store another key with access to server
on bar.com
, you don't have to type the password).
The functionality you were seemingly expecting is called tunneling or port forwarding (although must be configured separately). With this you establish two SSH sessions from desktop
first to bar.com
then another one to a different port of bar.com
which would be "bound" to port 22 of server
. In this scenario bar.com
would not have the ability to see "inside" the SSH session between desktop
and server
.
sls
part of your command. I'm not familiar with it. Can you provide more details?ssh
wouldn't make sense with such value for the-c
either.