hwsecurity-sdk / termbot

SSH client that works with YubiKeys, Nitrokeys, and other OpenPGP cards (based on the Hardware Security SDK)
https://hwsecurity.dev/termbot/
Other
84 stars 9 forks source link

Allowing forwarding the smartcard via SSH agent forwarding #3

Open Tycho-S opened 5 years ago

Tycho-S commented 5 years ago

Is your feature request related to a problem? Please describe.

I had a ticket open in the old repo for this, so I thought I'd just put one in here too for tracking purposes as I'm sure this request will come up. I know you're not working on it right now but maybe in the future?

The problem is I use agent forwarding for several things: Jump hosts, and also for sudo privileges. Together with the 'tap to sign' feature on the Yubikey this makes it safer to use sudo (rather than a password which can be keylogged)

Describe the solution you'd like

Having an option in termbot to forward the used key through SSH forwarding. At least the key used to log into the server in question. Having the choice for a different key would be even nicer but for me that wouldn't be needed.

Note: What I'm looking for is SSH forwarding, not GPG forwarding (though I saw a ticket from someone else looking for that :) )

Describe alternatives you've considered

I could store a key locally on the servers I connect to but this is much less safe. I also use TOTP/OATH (6-digit changing codes) right now but it's more hassle to enter the number every time.

dschuermann commented 5 years ago

We are currently not working on this feature, but I am open for pull requests to implement SSH agent forwarding.

iprok commented 5 years ago

I strongly need this feature, so I'm ready to sponsor implementing it with $50.

If somebody want to join sponsoring it, then you can use the link https://freedomsponsors.org/issue/870/allowing-forwarding-the-smartcard-via-ssh-agent-forwarding

wiktor-k commented 3 years ago

Just curious if anyone tried if forwarding with OKC Agent (https://play.google.com/store/apps/details?id=org.ddosolitary.okcagent) works?