Hacker News Reader

ssh-askpass is a great tool in these situations. It intercedes and allows you to manually control all key usage attempts.

View on HN

I'm not sure what relevance ssh-askpass has to what I wrote.

Right, this recipe isn't well known.

`ssh-add -c` will cause your ssh agent to pop up with ssh-askpass every time it does an authentication. This is fiddly; You need to have configured your ssh-agent right, and there's a slightly different version to use keychains on macos that's equivalent.

Once again, I'm not sure what relevance this has to the discussion.

Some people denounce all use of agent forwarding because, by default, ssh-agent doesn't confirm with the user before signing a request with the users private key. This means, if you ssh into a compromised/malicious host with your agent forwarded, malicious code on that machine can just silently ssh into other servers as you.

This trick has been used in the past by blackhats to escalate from a compromised CI environment to full production takeover.

GauntletWizard probably meant to respond to your parent in this thread.

Ah, a skillful execution of Cunningham's Law

Reply on news.ycombinator.com