pfSense

Sorin Sbarnea wrote:

I am in favour of enabling it by default because I see no security risks with it and it would be considerably easier to implement.

There are, in fact, significant security risks inherent in using SSH agent forwarding. While your forwarded session is active, anyone else on the pfSense box with sufficient privileges can connect to any other host using your forwarded SSH key. For more information, check out the following write-up.

https://heipei.github.io/2015/02/26/SSH-Agent-Forwarding-considered-harmful/

As a security professional, I do not support this change. pfSense is not a jump host or shell server. It's a security appliance, and needs to be configured and treated as such.

PS: I apologize if I've overstepped my bounds here. Not sure what proper Redmine netiquette is for the pfSense project.

It's always acceptable to voice security concerns, thanks for the input!

I think that the security concerns are not really so important because they make too many assumptions. First, it assumes your pfsense box was already pawned and second it states that the once this happened the perpetrator could use your ssh key to establish connections to other machines in your lan (the key cannot be obtained anyway). So, if someone if afraid of using an agent, they can always disable it use at the source (the client), there is no need to disable it as the server.

The funny part is that if the pfsense box is pwaned, the perpetrator could enable the ssh forwarding anyway. Mainly this renders the entire security concern unfounded because this change does not enable any new attack vector. To be valid, a security risk should demonstrate that a change is expected to downgrade the security of the product by allowing a malicious user to do something that he was not able to do before. Somehow I fail to see what was not possible before but it was possible after enabling this.

On the other hand, I do find the proposal of enabling this option in the UI as perfectly reasonable.

Another funny aspect is that this is a quote from official ssh manual, https://www.freebsd.org/cgi/man.cgi?sshd_config(5)

AllowAgentForwarding

So, default is yes, and is stated that there is no security threat with it :)

ssbarnea please resubmit your PR to the master branch