auditing-ssh-trust-and-agent-forwarding

name	auditing-ssh-trust-and-agent-forwarding
description	Audit secure-shell trust hygiene, not cipher hardening: a forwarded authentication agent a remote host can abuse to log in as you elsewhere, client configuration or a proxy-command directive influenced by an untrusted source, host-key verification disabled or blind-accepted so a machine-in-the-middle succeeds, and authorized-key entries whose forced command can be escaped or whose source and forwarding are unrestricted. Covers agent-socket exposure on multi-user or untrusted hosts, config and proxy-command injection from attacker-controlled data, trust-on-first-use gaps, and permissive key options. Use when auditing how hosts and users establish secure-shell trust and what a compromised endpoint can reach. The forwarded socket, injected directive, or unverified key is the source, authentication or command execution as an unintended identity is the sink.
license	MIT

Auditing SSH trust and agent forwarding: what a connected host can turn into your identity

Secure-shell security is usually discussed as ciphers and key lengths, which are largely solved. The unsolved part is trust: who can use your authentication, whose host key you accept without checking, and whose data shapes your client's behavior. A forwarded agent lets whatever host you land on authenticate as you to everything your key opens; a proxy-command or config entry pulled from an untrusted place runs on your machine or redirects your session; a disabled host-key check turns any network position into a man in the middle; a loose authorized-key entry hands more than intended. You find these by tracing where authentication and configuration flow and asking what a compromised or untrusted endpoint can do with them.

When to use

• You are auditing how users or automation establish secure-shell trust and what it reaches.
• Agents are forwarded, host keys are accepted, or client configuration comes from shared sources.