Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I was reading SSH tips and tricks from http://blogs.perl.org/users/smylers/2011/08/ssh-productivity-tips.html
There is a section on Onward Connections and the author warns not to use this unless you trust sys-admins on the middle servers.
I wanted to know what are the security implications of enabling Onward connections for SSH.
There is no security problem with SSH agent forwarding per se; that is, there is no additional risk that you would not see by manually logging in to the remote server and connecting to a third machine.
The risk lies in the fact that a malicious system owner (or attacker, if the system has already been compromised) is in a perfect position for a man-in-the-middle attack.
The MitM attack could come from several different vectors, although two come to mind specifically. The malicious admin could attempt to sslstrip an outgoing SSH connection so that your data (including credentials) is readable in transit, or he could change DNS so that you are connecting to an SSHd designed specifically to steal passwords, rather than the destination you were initially trying to reach.
Again, though, these risks would be present while using a third-party server even without specifically using SSH agent forwarding.
Hope this helps :)
scp Middle.Host:~/remote.file Third.Host:~/. In this case, the communication is entirely encrypted, but a MitM attack could occur from Middle.Host to Third.Host. If the data is already in plaintext, that is even easier!
scp command, I don't see any opportunity for MitM attacks. In fact, there's not even any agent forwarding in this scenario, if you are doing the scp from your local machine. Care to clarify your example and your answer?