openssh bugs - Aug 2008 - [Bug 1499] New: Add "ForwardAgent ask" to ssh_config

https://bugzilla.mindrot.org/show_bug.cgi?id=1499

           Summary: Add "ForwardAgent ask" to ssh_config
    Classification: Unclassified
           Product: Portable OpenSSH
           Version: 4.7p1
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: ssh
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: cjs at cynic.net


There are some machines I trust very little, but I still need my agent
to authenticate a connection from it, e.g., to checkout something from
a revision control system or copy a file.

Currently I ssh into those machines with the -A option, overriding the
"ForwardAgent no" in my config file as it applies to that machine, do
my checkout or whatever, and then exit and resume work in a session
without agent forwarding. This exposes me more than I would like.

I would like the ability to set "ForwardAgent ask" in my config file
(or on the command line), which would cause that ssh to forward the
request to the agent only if approved via the standard SSH_ASKPASS
mechanism.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1499


Curt Sampson <cjs at cynic.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |cjs at cynic.net




-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1499


Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org




--- Comment #1 from Damien Miller <djm at mindrot.org>  2009-01-22
11:37:26 ---
I think it would be nicer to ask the agent to require explict
confirmation of all private key operations make over specific
connections; i.e. rather than asking whether the agent should be
forwards, ask each time the key is used.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1499


Josh Triplett <josh at freedesktop.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |josh at freedesktop.org


--- Comment #2 from Josh Triplett <josh at freedesktop.org> 2009-09-01
04:45:22 EST ---
This seems fairly straightforward to implement:

1) Add a new flag to SSH2_AGENTC_SIGN_REQUEST, SSH_AGENT_NONLOCAL.

2) Add a new key constraint flag, SSH_AGENT_CONSTRAIN_CONFIRM_NONLOCAL.
 (Either as a separate flag, or by defining a two-bit field including
SSH_AGENT_CONSTRAIN_CONFIRM and this; doing the latter would allow a
fourth constraint possibility rather than the useless combination of
the two.)

3) If the connection has "ForwardAgent ask" (or some other sensible
configuration option) set, the local SSH will proxy the agent protocol
and add SSH_AGENT_NONLOCAL to all SSH2_AGENTC_SIGN_REQUEST messages.

4) The SSH agent, given a key with SSH_AGENT_CONSTRAIN_CONFIRM_NONLOCAL
set, will prompt iff the SSH_AGENT_NONLOCAL flag appears.



Note that this approach covers SSH2 key operations only.  Adding
support for SSH1 key operations would require a new protocol message,
since SSH_AGENTC_RSA_CHALLENGE has no flags field to extend.  This
doesn't seem necessary, though; just don't forward agents to hosts you
need SSH1 keys to log into.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1499



--- Comment #3 from Damien Miller <djm at mindrot.org> 2009-09-01 16:23:01
EST ---
I had something more simple in mind: have ssh(1) send a magic request
(SSH_AGENTC_CONSTRAIN_CHANNEL / SSH2_AGENTC_CONSTRAIN_CHANNEL) that
marks the entire listen socket as "untrusted" rather than doing it on
a
per-request basis. This has a couple of advantages:

1) no need to extend the per-request agent protocol. Presently unknown
requests are refused without killing the protocol, so ssh(1) can make
up its mind on whether to drop the connection if the agent refused the
constraint (e.g. to be determined by the ExitOnForwardingFailure
option)

2) a compromised ssh(1) can't like and get use of the keys after
connection. Since the agent connection is established before much
interaction with the server, there isn't much opportunity for a hostile
server to corrupt the client. Even if a ssh(1) is owned later, the
CONSTRAIN_CHANNEL message is irrevocable so the user has at least some
chance to see if something is awry. This might matter in some
configurations where ssh(1) is sandboxed in some way.

There are some caveats though:

1) ssh needs to learn to interpret (a subset of) the agent protocol.
Right now the agent is pretty much a dumb pipe.

2) We need to find some weasel wording for the manpage to explain the
trust relationship between the agent and the ssh client. Right now
there isn't much of one, but with this change ssh(1) will be trusted to
correctly label connections.

To go further than this, it might be possible to sign agent requests
with the host keys (or some derivative thereof) of each intervening
host that the agent is forwarded through, but this would need careful
design and analysis. It wouldn't be trivially backwards compatible like
this proposal either.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1499

Stefan Neufeind <mindrot.org at stefan-neufeind.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mindrot.org at stefan-neufeind
                   |                            |.de

--- Comment #4 from Stefan Neufeind <mindrot.org at stefan-neufeind.de>
2011-02-21 11:46:06 EST ---
Would be great to have some kind of "ask every time" in instead of
having to set it to a blind "yes" for the whole connection.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.