Is there any solution, or even work on, limiting which keys gets forwarded where?

[Daniel Kahn Gillmor]

On Thu 2015-10-15 10:34:43 -0400, hubert depesz lubaczewski wrote:

> I'm in a situation where I'm using multiple SSH keys, each to connect to
> different set of servers.
>
> I can't load/unload keys on demand, as I usually am connected to at
> least 2 of such sets.
>
> But - some rogue "root", could get access to my agent-forwarding socket,
> and in turn, get access to keys loaded to agent (not in terms of
> obtaining the key, but being able to use it to log to server he
> shouldn't be able to).
>
> As I understand the only solution is to run multiple ssh-agents, and
> load each key to only one of them, and then, before connecting, pick
> which agent to choose.

the better solution is to avoid forwarding an agent entirely, usually by
using a "jumphost" instead.  Have you tried and considered this
approach?  this approach doesn't permit any compromised intermediary
machine any access at all to your agent.

if the intermediary machine (the "jumphost") is jumphost.example, and
you are trying to reach bar.example.com (which is behind the firewall),
you would do:

 ssh -oProxyCommand='ssh jumphost.example -W %h:%p' bar.example.com

(this can also be placed in ~/.ssh/config, of course).

Another approach, if you find you must forward your agent, is to load
all keys in your agent with confirmation prompt required (ssh-add -c)
so that your local machine is still in control of when the different
keys get used.

There may be other approaches under development (some have been
discussed on this list recently) but please make sure you've considered
the jumphost approach, as it is strictly better than forwarded agents in
all cases except for large data transfers between the two remote hosts.

     --dkg