From dbcdea68ecd8c10fad0f3f7bdcc590e8e54ca763 Mon Sep 17 00:00:00 2001
From: djm <djm>
Date: Wed, 4 Sep 2002 06:40:37 +0000
Subject: [PATCH]    - stevesk@cvs.openbsd.org 2002/08/27 17:18:40     
 [ssh_config.5]      some warning text for ForwardAgent and ForwardX11; ok
 markus@

---
 ChangeLog    |  3 +++
 ssh_config.5 | 15 ++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 45672eaf..8a989bac 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -35,6 +35,9 @@
      [ssh-rsa.c]
      RSA_public_decrypt() returns -1 on error so len must be signed; 
      ok markus@
+   - stevesk@cvs.openbsd.org 2002/08/27 17:18:40
+     [ssh_config.5]
+     some warning text for ForwardAgent and ForwardX11; ok markus@
 
 20020820
  - OpenBSD CVS Sync
diff --git a/ssh_config.5 b/ssh_config.5
index 857cc964..82eda0a1 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.2 2002/08/17 23:55:01 stevesk Exp $
+.\" $OpenBSD: ssh_config.5,v 1.3 2002/08/27 17:18:40 stevesk Exp $
 .Dd September 25, 1999
 .Dt SSH_CONFIG 5
 .Os
@@ -258,6 +258,13 @@ or
 .Dq no .
 The default is
 .Dq no .
+.Pp
+Agent forwarding should be enabled with caution.  Users with the
+ability to bypass file permissions on the remote host (for the agent's
+Unix-domain socket) can access the local agent through the forwarded
+connection.  An attacker cannot obtain key material from the agent,
+however they can perform operations on the keys that enable them to
+authenticate using the identities loaded into the agent.
 .It Cm ForwardX11
 Specifies whether X11 connections will be automatically redirected
 over the secure channel and
@@ -269,6 +276,12 @@ or
 .Dq no .
 The default is
 .Dq no .
+.Pp
+X11 forwarding should be enabled with caution.  Users with the ability
+to bypass file permissions on the remote host (for the user's X
+authorization database) can access the local X11 display through the
+forwarded connection.  An attacker may then be able to perform
+activities such as keystroke monitoring.
 .It Cm GatewayPorts
 Specifies whether remote hosts are allowed to connect to local
 forwarded ports.
-- 
2.45.2