[PATCH 0/5] ssh-agent: confirmation for forwarded key use only

[Yannik Sembritzki]

Agent forwarding gives the remote host use of every key in the agent for
as long as the connection lasts. ssh-add -c limits that, but it prompts
for every local use too, which doesn't work well for scripted or parallel
connections (e.g. Ansible). Running a second agent just for forwarding
was suggested on this list before, but neither approach tells the user
which forwarded session a request came from or what it is for.

Since 8.9, ssh(1) binds forwarded agent connections with
session-bind at openssh.com and is_forwarding set, so ssh-agent can already
tell forwarded requests from local ones. This series uses that:

1/5 fixes the existing destination-constrained prompt, which copies the
    requester-supplied user name verbatim, so a forwarded request can
    inject extra lines into the askpass dialog. Independent of the rest.
2/5 shows the constraint host names instead of "listed host", resolving
    the XXX in process_sign_request2().
3/5 adds ssh-agent -O confirm-forwarded: confirmation is required for
    signatures over forwarded connections only. Local use is unchanged.
    Prompts for forwarded requests say what the request is for: the
    requested user and the destination host key, the latter only if the
    remote ssh(1) bound that session so the agent verified it. Agent only,
    no protocol change.
4/5 adds a session-hostname at openssh.com extension that ssh(1) sends just
    before the forwarding session-bind, so the prompt can name the host
    the agent was forwarded to. Accepted only before the first bind, so
    the remote host can't set it. Agents without support reply with a
    failure, which ssh(1) ignores.
5/5 adds regress/agent-confirm.sh.

Example prompt with the whole series, for a login from a jump host:

  Allow use of key user at laptop?
  Key fingerprint SHA256:....

  requested from host "jumphost" via agent forwarding
  for login as "root" to host key ED25519 SHA256:....

Without 4/5 the first detail line reads "requested via agent
forwarding". If the remote side didn't bind the session, the last line
reads "for login as "root" to unverified destination"; for other
signatures (e.g. ssh-keygen -Y sign on the remote host) it reads "NOT A
LOGIN REQUEST", set off by an empty line.

The destination is shown as a host key only: its name is only known to
the remote ssh(1), and the remote host's known_hosts decides whether the
key is trusted. Only with ssh-add -h does the agent have names it can
verify, which 2/5 shows.

Questions where I'd value your preference:

- An agent-wide -O option (like allow-remote-pkcs11) vs. a per-key
  constraint added by ssh-add. The option was simpler and covers the
  use case; a constraint would need a new constraint extension.
- 4/5 as a separate message vs. an extra field in session-bind. A
  separate message keeps session-bind unchanged for third-party agents.
- 4/5 sends options.host_arg (what the user typed). It is only sent for
  forwarding binds; the authentication bind in sshconnect2.c could send
  it too if you think that's useful for -c prompts.

Tested on Linux against current master: each commit builds without new
warnings, and the new agent-confirm test passes. In the full t-exec
suite, every test that passes on unmodified master in my environment
also passes with the series (the same 4 tests fail and 13 are skipped
there with and without it, for environment reasons). I also checked by
hand that a forwarded client can't inject prompt lines (1/5, 3/5), that
the destination host key shown is the real target's and unbound
requests are shown as unverified (3/5), that the remote host can't set
the hostname (4/5) with both patched and unpatched ssh(1), that patched
ssh(1) works with an unpatched agent, and that multi-hop forwarding with
patched clients works and logs nothing above debug level.

Yannik Sembritzki (5):
  ssh-agent: escape user name in confirmation prompt
  ssh-agent: name constraint hosts in confirmation prompt
  ssh-agent: add -O confirm-forwarded
  ssh, ssh-agent: show forwarding host in confirmation prompts
  regress: test agent confirmation prompts

 PROTOCOL.agent           |  22 ++++++
 authfd.c                 |  24 ++++++
 authfd.h                 |   1 +
 clientloop.c             |   2 +
 regress/Makefile         |   1 +
 regress/agent-confirm.sh | 135 ++++++++++++++++++++++++++++++++
 ssh-agent.1              |  15 ++++
 ssh-agent.c              | 161 +++++++++++++++++++++++++++++++++++++--
 8 files changed, 353 insertions(+), 8 deletions(-)
 create mode 100644 regress/agent-confirm.sh

-- 
2.56.0