auditing-ssh-trust-and-agent-forwardinglisted

# Auditing SSH trust and agent forwarding: what a connected host can turn into your identity Secure-shell security is usually discussed as ciphers and key lengths, which are largely solved. The unsolved part is trust: who can use your authentication, whose host key you accept without checking, and whose data shapes your client's behavior. A forwarded agent lets whatever host you land on authenticate as you to everything your key opens; a proxy-command or config entry pulled from an untrusted place runs on your machine or redirects your session; a disabled host-key check turns any network position into a man in the middle; a loose authorized-key entry hands more than intended. You find these by tracing where authentication and configuration flow and asking what a compromised or untrusted endpoint can do with them. ## When to use - You are auditing how users or automation establish secure-shell trust and what it reaches. - Agents are forwarded, host keys are accepted, or client configuration comes from shared sources. - A compromised or multi-tenant endpoint could abuse forwarded authentication or injected config. ## Scope check Audit secure-shell trust only for hosts, accounts, and automation you own or are authorized to assess. Using a forwarded agent or a key to reach systems outside scope is not part of the audit. If you can't name the authorization, stop. ## The loop 1. **Map where authentication is forwarded and to which hosts.** Inventory the connections and au