Skip to content

Commit f1dda96

Browse files
author
Tim Bannister
committed
Add security advice about SSH agent forwarding
In the case of a malicious node, or malicious superuser with access to the same node, SSH agent forwarding is a risk. Call that out.
1 parent 000536e commit f1dda96

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

content/en/docs/setup/production-environment/tools/kubeadm/high-availability.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -319,7 +319,8 @@ SSH is required if you want to control all nodes from a single machine.
319319
1. SSH between nodes to check that the connection is working correctly.
320320

321321
- When you SSH to any node, add the `-A` flag. This flag allows the node that you
322-
have logged into via SSH to access the SSH agent on your PC.
322+
have logged into via SSH to access the SSH agent on your PC. Consider alternative
323+
methods if you do not fully trust the security of your user session on the node.
323324

324325
```
325326
ssh -A 10.0.0.7

0 commit comments

Comments
 (0)