[PR #521] [MERGED] Implement ssh --forward-agent | -x functionality #549

New issue

Closed

opened 2026-05-07 00:21:27 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-07 00:21:27 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/ovh/the-bastion/pull/521
Author: @Exhar
Created: 1/22/2025
Status: ✅ Merged
Merged: 2/6/2025
Merged by: @speed47

Base: master ← Head: feature_ssh_agent_forwarding

📝 Commits (1)

57a3f33 Implement ssh --forward-agent | -x functionality

📊 Changes

6 files changed (+107 additions, -2 deletions)

View changed files

📝 bin/shell/osh.pl (+8 -0)
📝 doc/sphinx/administration/configuration/bastion_conf.rst (+12 -0)
📝 doc/sphinx/presentation/features.rst (+1 -0)
📝 etc/bastion/bastion.conf.dist (+6 -1)
📝 lib/perl/OVH/Bastion/configuration.inc (+1 -1)
➕ tests/functional/tests.d/346-testagentforward.sh (+79 -0)

📄 Description

This pull request addresses and resolves issue #252 by implementing the capability to enable SSH agent forwarding during an SSH session, with the egress key added to the agent.

The behavior is controlled by the sshAddKeysToAgentAllowed configuration option in bastion.conf, which is set to false by default. When this option is explicitly set to true, users can request SSH agent forwarding by including either the --forward-agent or -x argument on egress SSH sessions:

ssh --forward-agent <username>@<host>  
ssh -x <username>@<host>

This enhancement provides users with greater flexibility while maintaining the secure default settings and addresses the exact scenario described in #252.

Tests have been added in its own file, as I couldn't really find a more appropriate location to add the tests.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/ovh/the-bastion/pull/521 **Author:** [@Exhar](https://github.com/Exhar) **Created:** 1/22/2025 **Status:** ✅ Merged **Merged:** 2/6/2025 **Merged by:** [@speed47](https://github.com/speed47) **Base:** `master` ← **Head:** `feature_ssh_agent_forwarding` --- ### 📝 Commits (1) - [`57a3f33`](https://github.com/ovh/the-bastion/commit/57a3f33ecfa777a58cafcebd6b24b3a621a8069a) Implement ssh --forward-agent | -x functionality ### 📊 Changes **6 files changed** (+107 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `bin/shell/osh.pl` (+8 -0) 📝 `doc/sphinx/administration/configuration/bastion_conf.rst` (+12 -0) 📝 `doc/sphinx/presentation/features.rst` (+1 -0) 📝 `etc/bastion/bastion.conf.dist` (+6 -1) 📝 `lib/perl/OVH/Bastion/configuration.inc` (+1 -1) ➕ `tests/functional/tests.d/346-testagentforward.sh` (+79 -0) </details> ### 📄 Description This pull request addresses and resolves issue #252 by implementing the capability to enable SSH agent forwarding during an SSH session, with the egress key added to the agent. The behavior is controlled by the ``sshAddKeysToAgentAllowed`` configuration option in bastion.conf, which is set to ``false`` by default. When this option is explicitly set to ``true``, users can request SSH agent forwarding by including either the ``--forward-agent`` or ``-x`` argument on egress SSH sessions: ``` ssh --forward-agent <username>@<host> ssh -x <username>@<host> ``` This enhancement provides users with greater flexibility while maintaining the secure default settings and addresses the exact scenario described in #252. Tests have been added in its own file, as I couldn't really find a more appropriate location to add the tests. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>