LowSSHBLWK-SSH-010

SSH agent forwarding is enabled

What this means

AllowAgentForwarding is set to “‹allow agent forwarding›” in sshd_config. Agent forwarding lets anyone with root (or the forwarding user's privileges) on this host make use of the connecting client's SSH agent to authenticate onward as that client, without ever seeing the private key itself — a well-known lateral-movement technique on multi-hop SSH setups.

How to fix it

Set AllowAgentForwarding no in /etc/ssh/sshd_config unless agent forwarding is a deliberate requirement.

Check it yourself

Run a scan and look for BLWK-SSH-010 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sshd_config and reports this check when:

allow_agent_forwarding == "yes"

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1563

Related checks

• SSH password authentication is enabled · BLWK-SSH-001
• SSH root login is permitted · BLWK-SSH-002
• SSH allows empty passwords · BLWK-SSH-003
• SSH X11 forwarding is enabled · BLWK-SSH-004
• SSH TCP forwarding/tunneling is enabled · BLWK-SSH-005
• SSH permits user-set environment variables · BLWK-SSH-006