Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work for two companies (let's call them RedCorp and BlueCorp). They both trust me but they don't trust each other, and I don't want to expose either's secrets to the other.

My laptop's ssh-agent has two private keys, one for access to each company. I can run:

ssh -A redcorp-server1

and access all of redcorp's other servers from there, by virtue of my forwarded agent connection.

Likewise, I can run:

ssh -A bluecorp-server1

and access all of bluecorp's other servers from there.

The problem is that whenever I'm logged into redcorp-server1, the root user there can set his $SSH_AUTH_SOCK to point at my forwarded agent connection, and abuse my other identity to break into BlueCorp.

How can I prevent that?

ssh's IdentitiesOnly option doesn't do what I want. That only controls which key I offer when authenticating to redcorp-server1; it doesn't change the fact that my forwarded agent connection allows an ssh process on redcorp-server1 to authenticate using any of my identities.

The only solution I've found is to run two separate ssh-agents, and only load one key into each of them. That's a huge pain though: There's no way for an ssh_config stanza to specify which of my agents I should use when connecting to a given host. Instead I've had to make shell aliases on my laptop for each of the two corps which point $SSH_AUTH_SOCK to the right agent before running ssh. Also, I use rsync and a dozen other tools which use ssh as a transport, and each of them has to be configured using a different syntax to make it invoke ssh in this special way.

Is there a better way to do this?

share|improve this question
I don't think this functionality exists. It would be a great idea to write a proxy agent that filters SSH agent requests so that sessions under that proxy could see only a subset of keys. It could probably be made so that it is used as a prefix to the ssh command line like ssh-agent-filter -i allow_this_fingerprint ssh rest-of-command-line –  Celada Mar 19 '13 at 1:39
Would it be possible to just not use ForwardAgent on your connections? –  Jenny D Mar 19 '13 at 8:39
add comment

1 Answer 1

I don't get the problem. If you set and export $SSH_AUTH_SOCK to the appropriate value then programs which call ssh should not need any modification. Of course, the target of e.g. an rsync call must be compatible with the selection of the ssh-agent.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.