ssh-agent-filter

the problem we want to solve

ssh(1) describes the problem:

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.

our solution

1. create one key(pair) for each realm you connect to
2. load keys into your ssh-agent as usual
3. use ssh-agent-filter to allow only the key(s) you need

afssh (agent filtered ssh) can wrap ssh-agent-filter and ssh for you, forwarding only the key with the comment id_example:

$ afssh --comment id_example -- example.com

starts an ssh-agent-filter --comment id_example, runs ssh -A example.com and kills the ssh-agent-filter afterwards.

If you leave out the options before the --:

$ afssh -- example.com

it will ask you via whiptail or dialog which keys you want to have forwarded.

confirmation

You can use the --*-confirmed options (e.g.--comment-confirmed) to add keys for which you want to be asked on each use through the filter. The confirmation is done in the same way as when you ssh-add -c a key to your ssh-agent, but the question will contain some additional information extracted from the sign request.

how it works

ssh-agent-filter provides a socket interface identical to that of a normal ssh-agent. We don't keep private key material, but delegate requests to the upstream ssh-agent after checking if the key is allowed.

The following requests are implemented:

• SSH2_AGENTC_REQUEST_IDENTITIES:
  • asks for a list of SSH 2 keys
  • the upstream ssh-agent is asked for that list and the result is filtered
• SSH2_AGENTC_SIGN_REQUEST:
  • asks for a signature on some data to be made with a key
  • if the key is allowed the request is forwarded to the upstream ssh-agent and the result returned
  • else failure is returned
• SSH_AGENTC_REQUEST_RSA_IDENTITIES:
  • asks for a list of SSH 1 keys
  • an empty list is returned
• SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES:
  • asks for removal of all SSH 1 keys
  • success is returned without doing anything

Requests to add or remove keys and to (un)lock the agent are refused