Lesson 4.57: The SSH client and the bastion
Most SSH hardening happens on the server, but the client's configuration decides where your keys go. Agent forwarding lets every host you log in to use your keys while you're connected, so whoever is root there can borrow them. ProxyJump reaches internal servers through a bastion without that. In the lab your ~/.ssh/config looks safe but a Host * block at the top quietly wins over everything below it. You read the effective configuration with ssh -G, rewrite the file in the right order, then lock the bastion's sshd down to plain jumps.
17 min
You will learn to
- Read the effective client configuration with ssh -G
- Explain 'first obtained value wins' in ssh_config
- Use ProxyJump instead of agent forwarding
- Keep host key checking on
- Restrict a bastion's sshd to jumps
Key terms
- ssh -G
- Prints the configuration ssh would use for a host, after all files and blocks are applied, without connecting.
- First obtained value wins
- ssh_config rule: for each option the first matching value is kept; later ones are ignored.
- Agent forwarding
- Lets a remote host ask your local ssh-agent to sign with your keys while you're connected.
- ProxyJump
- Reaches a host through a jump host with a separate end-to-end SSH session.
- StrictHostKeyChecking
- What to do with unknown or changed host keys; ask (default) or yes, never no.
- PermitOpen
- sshd option limiting where forwarded TCP channels may connect.
← A static address with netplan · All lessons · Sweeping for persistence →