Disable SSH Agent Forwarding
Forbid the SSH server from relaying a client's authentication agent socket (AllowAgentForwarding no). Without it, anyone with root on the server can hijack the socket of a connected administrator and authenticate as that person on every other machine their keys open.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
What Pavois checks
Pavois runs sshd -T and requires the resolved line allowagentforwarding no. sshd -T prints the configuration the daemon actually applies, after every Include and every drop-in in /etc/ssh/sshd_config.d/. Reading /etc/ssh/sshd_config directly would miss a drop-in that re-enables forwarding downstream and produce a false negative.
describe command('sshd -T') do
its('stdout') { should match(/^allowagentforwarding\s+no$/i) }
endHow to verify it is applied
Run sshd -T | grep -i allowagentforwarding as root. Expected output:
allowagentforwarding no
End to end: connect with ssh -A user@host and check that $SSH_AUTH_SOCK is empty in the remote shell.
Inspect & investigate
At the default LogLevel INFO, refusing an agent-forwarding request produces no log line: sshd only emits agent forwarding disabled at debug level. The observable signal is on the client side ($SSH_AUTH_SOCK unset in the session). Connection and authentication events remain in /var/log/auth.log (Debian/Ubuntu), /var/log/secure (RHEL) or journalctl -u ssh.
Remediation
The Pavois harden plan uses the sshd_setting resource to force the directive allowagentforwarding to no in the Pavois drop-in under /etc/ssh/sshd_config.d/. The generated file is validated with sshd -t -f <file> before being kept, and a change notifies a reload of ssh.service: no restart, so existing sessions are not dropped.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| directive | allowagentforwarding |
|---|---|
| notify | action: reload, service: ssh.service |
| resource | sshd_setting |
| value | no |
| verify | sshd -t -f %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving agent forwarding on turns every server an admin logs into with ssh -A into a stepping stone: root on that box can use the forwarded socket to sign challenges with the admin's private keys, without ever reading them. Before applying, look for workflows that rely on ForwardAgent (git push from the server, ssh -A bounces, deployment or CI scripts). The supported replacement is client-side ProxyJump (ssh -J bastion host), which never exposes the agent to the intermediate host. The reload keeps current sessions alive; forwarding stops for new sessions only.