Lion Cipher Lab
Run ssh-agent as your daily driver, then measure the agent-forwarding hijack and shut it down
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The ssh-agent is the single most-used credential on an engineer's machine: load your key once, and it signs every login all day so you never retype a passphrase. The catch is that the moment you add `-A` (agent forwarding) to reach a server through a jump box, you hand that server's root the ability to log in AS YOU to everything your key opens — without ever seeing your private key. This is a top way attackers turn one compromised hop into a whole fleet. You will prove the hijack on your own throwaway containers, then shut it down and watch the reachable-host count fall from 3 to 0.
What you'll learn
- Running ssh-agent and loading keys with ssh-add
- Understanding SSH_AUTH_SOCK and what agent forwarding really exposes
- Demonstrating an agent-forwarding hijack defensively on your own containers
- Fixing it three ways: ssh-add -t, ssh-add -c, and ProxyJump (-J)
- Per-host IdentitiesOnly / IdentityFile hygiene in ~/.ssh/config
- Managing the Windows ssh-agent service
Steps in this lab
- What an ssh-agent is, in one breath
- What this lab is NOT (so you place it correctly)
- Start the agent and load one key
- Build the disposable two-hop lab
- Turn on agent forwarding and feel why it is tempting
- MEASURE the hijack from root's seat on the bastion
- Fix 1 (partial): cap the key's lifetime with ssh-add -t
- Fix 2 (and its honest failure): confirm each use with ssh-add -c
- Fix 3 (the real one): ProxyJump keeps the agent on your machine
- Daily hygiene: -l, -D, and pinning identities in ~/.ssh/config
- Windows note: the ssh-agent service as your daily driver
- What you proved, and the instinct to keep