Very interesting food for thought. So let me make sure I understand what I need to do here as I try to reverse 2 decades of cluelessness (I literally never heard of agent forwarding until last night): So I'll add the pem file with ssh-add on my local machine and then I'll be able to log into C and then once in C I can run the scp command to move files between B and A via the private network. Have I got that right? On Wed, Dec 9, 2020 at 2:39 PM Brian Candler <b.candler@xxxxxxxxx> wrote: > On 09/12/2020 18:45, Steve Dondley wrote: > > Ok, thanks for the insight. > > > > Yeah, I was trying to avoid agent forwarding because of the advice > > I've seen to avoid it, if possible. > > As far as I know, you'd mainly want to avoid it if you don't trust the > left-hand machine (i.e. the source, the one you called "B"). A > malicious administrator on that host could connect to your agent socket > and authenticate, as you, to any other machine that trusts your key. > > But to be honest, if a machine is malicious, I wouldn't want to ssh into > it in the first place. It could do plenty of other nasty things, such > as logging my keystrokes. > > > > > Only other method I can think of is to have a third machine, machine > > C, that is only available on the private network and contains the > > private key for all the other machines. So I'd log into machine C via > > some bastion/jump server. Machine C would hold the private the > > key used by machine B and machine A and I could use it to transfer > > files between machines A and B. > > Copying your private key onto other machines is, in general, way less > secure than using agent forwarding. > > You could ssh to C (that you trust), with agent forwarding enabled, and > use it to third-party copy between B and A (*without* enabling agent > forwarding from C to B or C to A) > > > -- Prometheus Labor Communications, Inc. http://prometheuslabor.com 413-572-1300 UnionConnect Phone App for Labor Unions http://unionconnect.com _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
