Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, namely:

To login to a system and then continue from that system to a third (as illustrated below) should be avoided.

Illustration
Illustration recommending against SSH chains

Why should such chains of SSH sessions be avoided?

share|improve this question

2 Answers 2

up vote 9 down vote accepted

Each system along the way with the proper priviledge could "hijack" your session (see the man page about ssh-agent, for some warnings. And search on this site and on the web for some more info) (sorry I do not have time right now to properly give examples...) :

  • For example the SSH_AUTH_SOCK could be accessible to another instance of the user or to root (or, depending on the system's settings, to a wider group of users), and be used to access whatever system that you could access yourself using the keys stored in the agent.

Having only 1 base system to control and use the agent on is much easier to secure and control. Otherwise, each intermediary hop adds a (potentially weaker) point of entry for some of the users on that system.

Please note that there are also many other ways in which an intermediary system could compromise your ssh connection. Some via ssh mechanisms itself, but also some via the tty/terminals themselves, etc.

The more hop you go through, the more risk you take that one of those hops (including your original machine!) can be used to hijack your connection [to the final destination, or to any of the intermediary hops, or even to any other destination that your ssh keys could open access to ...]

share|improve this answer

That link has the diagram in the context of damage control.

In the right-hand diagram, if one of the far-right machines has been compromised, the attacker cannot continue to other servers.

However, on the left hand, 'chain' scenario, if any one of the boxes is compromised, he can continue down the chain and compromise each system in turn. This is assuming public-key authentication is used, but I think that is what the author is trying to convey.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.