[Contents] [Index]

About This Document >>     Installing SSH Tectia Server for IBM z/OS >>     Getting Started with SSH Tectia Server for IBM z/OS >>     Configuring the Server >>     Configuring the Client >>         Client Configuration Files>>         Ciphers and MACs         Compression         Securing the Client             Disabling Agent Forwarding         Default ssh2_config Configuration File     Authentication >>     File Transfer Using SFTP >>     File Transfer Using Transparent FTP Tunneling >>     Tunneling on the Command Line >>     Troubleshooting SSH Tectia Server for IBM z/OS >>     Advanced Information >>     Man Pages >>     Log Messages >>

Disabling Agent Forwarding

By default, when you have an agent running, the agent connection will be forwarded to the server side. This is for convenience, so that a system admin (or a power user) can easily hop from machine to machine.

If the server's administrator is malicious, he can use your agent to sign requests. This will not allow access to the private key, but will cause a security risk, because the malicious admin can then connect with your credentials anywhere where they are accepted.

So, if you do not trust the server, disable agent forwarding in your ssh2_config file:

ForwardAgent no

On the command line, the -a option has the same effect:

% ssh2 -a host