{"action":"created","issue":{"url":"https://api.github.com/repos/mitchellh/packer/issues/2298","labels_url":"https://api.github.com/repos/mitchellh/packer/issues/2298/labels{/name}","comments_url":"https://api.github.com/repos/mitchellh/packer/issues/2298/comments","events_url":"https://api.github.com/repos/mitchellh/packer/issues/2298/events","html_url":"https://github.com/mitchellh/packer/issues/2298","id":90486797,"number":2298,"title":"Make ssh agent forwarding disabled by default","user":{"login":"andytson","id":199783,"avatar_url":"https://avatars.githubusercontent.com/u/199783?v=3","gravatar_id":"","url":"https://api.github.com/users/andytson","html_url":"https://github.com/andytson","followers_url":"https://api.github.com/users/andytson/followers","following_url":"https://api.github.com/users/andytson/following{/other_user}","gists_url":"https://api.github.com/users/andytson/gists{/gist_id}","starred_url":"https://api.github.com/users/andytson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andytson/subscriptions","organizations_url":"https://api.github.com/users/andytson/orgs","repos_url":"https://api.github.com/users/andytson/repos","events_url":"https://api.github.com/users/andytson/events{/privacy}","received_events_url":"https://api.github.com/users/andytson/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-23T20:45:47Z","updated_at":"2015-06-23T20:51:41Z","closed_at":"2015-06-23T20:49:39Z","body":"SSH Agent Forwarding is a bad idea to be enabled by default. Agent forwarding lulls people into thinking they can use it to securely use their SSH key authentication on the server, but has a big problem that it can't easily be secured.\r\n\r\nAny person with root permissions (or root via sudo) can find the socket that was created on the server, and use that socket for their own purposes, which allows them to authenticate with other servers the person SSHing in has access to.\r\n\r\nThe agent itself by default doesn't have any way to prevent this. Although it's possible to sort out a solution that asks for confirmation, most people wont even be aware of the issue.\r\n\r\nSince it's best to institute security by default, I think it best that this is disabled by default, and a warning message put in the documentation to say enabling it might have this problem."},"comment":{"url":"https://api.github.com/repos/mitchellh/packer/issues/comments/114638832","html_url":"https://github.com/mitchellh/packer/issues/2298#issuecomment-114638832","issue_url":"https://api.github.com/repos/mitchellh/packer/issues/2298","id":114638832,"user":{"login":"mitchellh","id":1299,"avatar_url":"https://avatars.githubusercontent.com/u/1299?v=3","gravatar_id":"","url":"https://api.github.com/users/mitchellh","html_url":"https://github.com/mitchellh","followers_url":"https://api.github.com/users/mitchellh/followers","following_url":"https://api.github.com/users/mitchellh/following{/other_user}","gists_url":"https://api.github.com/users/mitchellh/gists{/gist_id}","starred_url":"https://api.github.com/users/mitchellh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mitchellh/subscriptions","organizations_url":"https://api.github.com/users/mitchellh/orgs","repos_url":"https://api.github.com/users/mitchellh/repos","events_url":"https://api.github.com/users/mitchellh/events{/privacy}","received_events_url":"https://api.github.com/users/mitchellh/received_events","type":"User","site_admin":false},"created_at":"2015-06-23T20:51:40Z","updated_at":"2015-06-23T20:51:40Z","body":"Hm, I'm not sure, assume I'm wrong on that. The rest is valid."}}