How to disable ssh-agent forwarding

Question

ssh-agent forwarding can be accomplished with ssh -A ....

Most references I have found state that the local machine must configure ~/.ssh/config to enable AgentForwarding with the following code:

Host <trusted_ip>
  ForwardAgent yes

Host *
  ForwardAgent no

However, with this configuration, I am still able to see my local machines keys when tunneling into a remote machine, with ssh -A user@remote_not_trusted_ip, and running ssh-add -l.

From the configuration presented above, I would expect that the ssh-agent forwarding would fail and the keys of the local machine would not be listed by ssh-add -l.

Why is the machine @remote_not_trusted_ip able to access the ssh-agent forwarded keys even though the ~/.ssh/config file states the following?

Host *
  ForwardAgent no

How can i prevent ssh-agent from forwarding keys to machines not explicitly defined in the ~/.ssh/config?

Answer 1

How can i prevent ssh-agent from forwarding keys to machines not explicitly defined in the ~/.ssh/config?

It is the default behavior. If you do not allow it in ~/.ssh/config it will not be forwarded. But the command-line arguments have higher priority so it overwrites what is defined in the configuration,as explained in the manual page for ssh_config:

ssh(1) obtains configuration data from the following sources in the following order:

1. command-line options
2. user's configuration file (~/.ssh/config)
3. system-wide configuration file (/etc/ssh/ssh_config)

So as already said, you just need to provide correct arguments to ssh.

So back to the questions:

Why is the machine @remote_not_trusted_ip able to access the ssh-agent forwarded keys even though the ~/.ssh/config file states the following?

Host *
  ForwardAgent no

Because the command-line argument -A has higher priority than the configuration files.

How can I prevent ssh-agent from forwarding keys to machines not explicitly defined in the ~/.ssh/config?

Do not use -A command-line option if you do not want forward your ssh-agent. Use -a command-line option instead.

Answer 2

You are using -A option to connect. man ssh says :

-A Enables forwarding of the authentication agent connection.

You should connect without -A, just using :

ssh user@remote_not_trusted_ip

CLI args will have priority on ssh config file.

By the way, if you want to connect to your trusted ip without forwarding, you can also use :

ssh -a user@trusted_ip

-a Disables forwarding of the authentication agent connection.