We connect to the servers via the "FOOBAR" machine.

desktop -> FOOBAR(bar.com) -> server

FOOBAR can log our SSH connections, what we type, etc.

We log in via the following command:

ssh -A -t foouser@bar.com sls -c targetuser@targetserver

sls is "Secure Logging Service"

On the target server side, we can see that our public key is used for logging in to the target server.

Our private key is private, only on desktop.

ssh doesn't display any warning.

Question: How is this possible? Isn't it violating SSH end-to-end encryption?

  • 1
    Hello and welcome to Information Security! You are using ssh agent forwarding.Why do you believe this is violating SSH? – Jedi Jul 6 '16 at 10:51
  • "FOOBAR can log our SSH connections, what we type, etc. " -> ssh agent allows that the FOOBAR can sniff in the connection? isn't it encrypted end-to-end – Peter84753 Jul 6 '16 at 14:09
  • 3
    I'm interested in the sls part of your command. I'm not familiar with it. Can you provide more details? – schroeder Jul 6 '16 at 14:14
  • I'm taking a guess at two commands squeezed in one line and edit accordingly. OP mentioned "commands" and ssh wouldn't make sense with such value for the -c either. – techraf Jul 7 '16 at 2:51
  • It is in ONE LINE! Don't put the "sls" part in to a second one!! fixed the "commands" part too. – Peter84753 Jul 8 '16 at 10:34

When you execute:

ssh -A -t foouser@bar.com

you are establishing a session between desktop and bar.com. From now on, everything you type within this session is interpreted by and executed on bar.com.

Then you establish a session from bar.com to server (sls is not a standard command, but I assume it is a wrapper for another SSH connection).

You have a second session encrypted between bar.com and server. This session is authenticated with your private key which is stored on the desktop machine.

In the first command you have -A argument which enables agent forwarding. This mechanism allows encrypting the session between bar.com and the server, using the desktop machine (and the private key stored there) for authentication.

It does not mean the second connection is encrypted end-to-end between desktop and server, it just means desktop authorised a session between bar.com and server.

The situation cannot be likened to an attack, because you deliberately choose to use the feature for your own convenience and security (your private key does not leave your machine, you don't store another key with access to server on bar.com, you don't have to type the password).

The functionality you were seemingly expecting is called tunneling or port forwarding (although must be configured separately). With this you establish two SSH sessions from desktop first to bar.com then another one to a different port of bar.com which would be "bound" to port 22 of server. In this scenario bar.com would not have the ability to see "inside" the SSH session between desktop and server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.