I got tired remembering passphrases for my SSH logins and heard about pam_ssh_agent_auth. Unfortunately I hadn't found any security audit of it and I don't know enough low-level details about SSH to evaluate how safe those 6K lines of C code is.

Is pam_ssh_agent_auth reasonably safe to use on production machines? If so, what should I watch out for when setting it up? One thing that comes to my head is disabling SSH agent forwarding.


We ship it and use it in Fedora and RHEL. It is here for a long time and it is using the code from openssh for almost all the public key operations (and openssh is using openssl). The code is quite fair.

The pam_ssh_agent_auth itself basically does only verification that the public key matches and that the signature provided by ssh-agent is valid. All the private key operations are still left on your ssh-agent.

It is not clear what is going to be your exact use case from this question, but from my POV, the most powerful thing on this is having single agent on local machine to log in to all the servers and allowing sudo operations there (or use separate key for this module). It exposes a bit "single point of failure" (if you lose the unencrypted key, it would be a problem, but this module does not expose it).

You should probably disable ssh-agent forwarding for untrusted hosts (or by default and whitelist your trusted), maybe also add the key with -c switch to confirm PK actions or some timeout (-t to let it expire).

| improve this answer | |
  • this -c thing sounds interesting! I can't find it in man pages though - which command's switch is it? For ssh it's cipher selection, for ssh-agent: Generate C-shell commands on stdout. This is the default if SHELL looks like it's a csh style of shell. – d33tah Jun 8 '16 at 20:41
  • 1
    It is ssh-add. – Jakuje Jun 8 '16 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.