From f1dda969c4ece8619985041af52ec92946d6f822 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Mon, 17 Jan 2022 21:38:46 +0000 Subject: [PATCH] Add security advice about SSH agent forwarding In the case of a malicious node, or malicious superuser with access to the same node, SSH agent forwarding is a risk. Call that out. --- .../production-environment/tools/kubeadm/high-availability.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/high-availability.md b/content/en/docs/setup/production-environment/tools/kubeadm/high-availability.md index b699e6642c..dd5106985c 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/high-availability.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/high-availability.md @@ -319,7 +319,8 @@ SSH is required if you want to control all nodes from a single machine. 1. SSH between nodes to check that the connection is working correctly. - When you SSH to any node, add the `-A` flag. This flag allows the node that you - have logged into via SSH to access the SSH agent on your PC. + have logged into via SSH to access the SSH agent on your PC. Consider alternative + methods if you do not fully trust the security of your user session on the node. ``` ssh -A 10.0.0.7