Lock your ssh-agent and it should sit there refusing to sign anything until you unlock it. In OpenSSH 10.4, locking it also switched off the check that tells the agent whether a request came from your own machine or arrived down a forwarded connection from a remote server. The fix shipped today in OpenSSH 10.5. The agent holds your decrypted private keys so you are not retyping a passphrase every few minutes, and agent forwarding … More →
The post Locking your ssh-agent exposed local-only keys until OpenSSH 10.5 appeared first on Help Net Security.