Client Configuration
Connecting to servers whose admin you do not trust and who may be
malicious is a significant security risk. Avoid it. However, there are
a few ways to reduce the risk.
Disabling X11 Forwarding
X11 forwarding exposes your X server (the client side in this context)
to a malicious root user on the server machine.
If you are connecting to a host you do not trust, or where you do not need
execute X applications, disable X11 forwarding.
In your ssh2_config file, add the following line:
On the command line, the -x option has the same effect:
% ssh2 -x host
Disabling Agent Forwarding
By default, when you have an agent running, the agent connection will be
forwarded to the server side. This is for convenience, so that a system
admin (or a power user) can easily hop from machine to machine.
If the server's administrator is malicious, he can use your agent to
sign requests. This will not allow access to the private key, but will
cause a security risk, because the malicious admin can then connect with
your credentials anywhere where they are accepted.
So, if you do not trust the server, disable agent forwarding in your
ssh2_config file:
On the command line, the -a option has the same effect:
% ssh2 -a host
