SSH Tectia  
Previous Next Up [Contents] [Index]

    About This Document >>
    Installing SSH Tectia Server >>
    Getting Started >>
    Configuration >>
        Configuration Files >>
        Subconfigurations >>
        Enabling FIPS Mode
        Ciphers and MACs
        Compression
        Configuring Root Logins
        Restricting User Logins
        Subsystems
        Configuring ssh2 for ssh1 Compatibility
        Auditing >>
        Securing SSH Tectia Client and Server >>
            Server Configuration
            Client Configuration
    Authentication >>
    Application Tunneling >>
    Troubleshooting >>
    Man Pages
    Advanced Options >>
    Log Messages >>

Client Configuration

Connecting to servers whose admin you do not trust and who may be malicious is a significant security risk. Avoid it. However, there are a few ways to reduce the risk.

Disabling X11 Forwarding

X11 forwarding exposes your X server (the client side in this context) to a malicious root user on the server machine.

If you are connecting to a host you do not trust, or where you do not need execute X applications, disable X11 forwarding.

In your ssh2_config file, add the following line:

ForwardX11          no

On the command line, the -x option has the same effect:

% ssh2 -x host

Disabling Agent Forwarding

By default, when you have an agent running, the agent connection will be forwarded to the server side. This is for convenience, so that a system admin (or a power user) can easily hop from machine to machine.

If the server's administrator is malicious, he can use your agent to sign requests. This will not allow access to the private key, but will cause a security risk, because the malicious admin can then connect with your credentials anywhere where they are accepted.

So, if you do not trust the server, disable agent forwarding in your ssh2_config file:

ForwardAgent        no

On the command line, the -a option has the same effect:

% ssh2 -a host

Previous Next Up [Contents] [Index]


[ Contact Information | Support | Feedback | SSH Home Page | SSH Products ]

Copyright © 2010 SSH Communications Security Corp.
This software is protected by international copyright laws. All rights reserved.
Copyright Notice