I am thinking about this lately a lot, so I wanted to get someone else's opinion.

Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, of course, passphrase-protected). What stops a malware (running as a current user) from exploiting this, connecting to a SSH host and possibly running remote commands?

I hope that my understanding of this is flawed but, as long as agent is running in background, I can issue an ssh command and go right through the login.

Can you please help me confirm whether this is correct?

If this is in fact valid attack vector, what would be the best a way of protecting myself from it?


  • 1
    Take a look at the “Security issues” section of en.wikipedia.org/wiki/Ssh-agent – Steve Nov 28 '18 at 15:51
  • Aha, thanks Steve! This clarifies everything! :) Can you please add it as answer so I could mark it as accepted? – Jovan Perovic Nov 28 '18 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.