ssh-ident

I don't. Each agent gets one key, and that key alone. That's what helps. https://github.com/ccontavalli/ssh-ident is what I use to manage those agents - one agent per key.

If a bad guy gets root on one server you're currently connected via ssh with, and forwarding said key via, they can also access (unless otherwise firewalled) all systems that ssh key grants them access to. See also: https://github.com/FiloSottile/whoami.filippo.io Using a private key per system or set of systems means that such an attacker would only gain access to what that key grants them access to. My "github" key only grants access to my github repos, not to my bitbucket repos or to my DigitalOcean servers, or my Scaleway servers. I have an SSH key for each "thing", and each key is kept in a different keyring via https://github.com/ccontavalli/ssh-ident, _precisely_ to avoid that problem. As an example, an attacker gaining root on my Oracle Cloud free server will not be able to clone all my Github repos with it: I only use that key to

For SSH, I use one key per service, and manage them via https://github.com/ccontavalli/ssh-ident - to ensure that each connection only has access to the key it should, according to the configuration, have access to. I can't stress enough the importance of doing this - using either this tool, or something similar (like manually managing ssh agents). Using one key only would mean that any server you ssh to has (assuming you forward the ssh auth/roaming) the ability to "forward" that connection, and do evil things with it. See https://blog.filippo.io/ssh-whoami-filippo-io/ for more about it. Having multiple keys and only using an agent with the "right" key for the "thing" mean that each "thing" you SSH to would, in the above scenario, not be able to inflict any damage at all. That is, ssh'ing into your personal dev box wouldn't give the dev

> At the end of a successful login, tsh login command now sends the SSH certificate to an active SSH agent. Will it ever be able to create, and use, a DIFFERENT agent? I use https://github.com/ccontavalli/ssh-ident in order to have a different agent per "kind" of hosts, so that if I mistakenly ssh to Mallory's ssh server with my default agent, they won't be able to, say, also pull all my private Github repos. To use teleport as securely, I'd have to - again - concoct a script or something to "pass through ssh-ident". This is tiresome :|

I use ssh-ident. It creates a separate ssh agent for each identity you use and you can setup a different identity for each host or ssh argument. And if worse comes to worse, it will prevent someone running off with all the keys you are currently using because instead they only have access to that one agent, not all your agents. The downsides (besides possible security implications of trusting someone else's code to manage your keys) is that tools like rsync and scp won't work straight out of the box. You have to either alias ssh to ssh-ident, or provide the path to ssh-ident yourself. https://github.com/ccontavalli/ssh-ident

How about https://github.com/ccontavalli/ssh-ident ? Is that still a "best practice", since the author doesn't mention it in this blog entry?

There's something I found on hacker news awhile back that can allow you to use ForwardAgent while limiting your identities so that you can forward your ssh agent, but it only forwards the identity you used to connect to that server. It starts up a separate agent for each identity when you invoke it. You can find it at: https://github.com/ccontavalli/ssh-ident

This is a very valid issue. I have been using ssh-ident* for this reason. You can add keys to ~/.ssh/identities and it'll start up an agent for each identity when you use it. This means if the machine you connect to is indeed stealing your keys, at least they only have one key, not all the keys you're currently using. There are some caveats; such as having to specify what domains/IPs should use which identity, and also having to alias ssh to get it to work nicely. So it's not perfect, but it does solve the problem you talked about. * https://github.com/ccontavalli/ssh-ident