SSH forwarding is the tunnel feature that lets one SSH session carry other traffic through the connection. It can be useful for administration, but it also extends trust beyond the shell if not tightly scoped and explicitly approved.
Expanded Definition
SSH forwarding is a transport mechanism inside SSH that relays other network traffic through an authenticated session. In NHI operations, that means a single privileged connection can become a pathway to databases, internal APIs, or admin interfaces that were never directly exposed to the user’s workstation.
Definitions vary across vendors and teams when forwarding is used for convenience versus when it is treated as a governed access path. NHI Management Group treats it as a privileged trust extension because it can bypass direct network exposure controls and shift enforcement from the destination system to the SSH session itself. That is why forwarding should be understood alongside NIST Cybersecurity Framework 2.0 concepts such as access control and protective architecture, not as a simple shell feature.
In practice, SSH forwarding includes local, remote, and agent forwarding, and each has different risk implications. Agent forwarding is especially sensitive because it can expose credentials indirectly if the remote host is compromised. The most common misapplication is treating forwarding as a harmless troubleshooting convenience, which occurs when organisations permit it on shared bastion hosts without explicit destination scoping or session-level approval.
Examples and Use Cases
Implementing SSH forwarding rigorously often introduces operational friction, requiring organisations to weigh faster administration against tighter session controls and auditability.
- A platform engineer opens a local tunnel through a bastion host to reach a private PostgreSQL instance during maintenance, while the connection is time-bound and recorded.
- A security team blocks agent forwarding on jump servers because a compromised remote host could misuse the caller’s ssh agent and extend access beyond the intended session.
- An SRE uses remote forwarding to expose a temporary internal webhook endpoint for debugging, then revokes the rule immediately after validation.
- A governance team references the Ultimate Guide to NHIs to align tunnel use with service-account lifecycle controls and secret handling expectations.
- An organisation compares forwarding policy design with NIST Cybersecurity Framework 2.0 to ensure access paths are protected, monitored, and limited to approved business need.
Forwarding is most useful when direct network access is intentionally absent, but a controlled operator path is still needed for support, incident response, or break-glass administration.
Why It Matters in NHI Security
SSH forwarding matters because it can quietly convert a legitimate NHI access path into a broad trust bridge. If an SSH session is allowed to relay traffic without strict approval, the session can become a proxy for credentials, internal services, or tooling that were never meant to be reachable from that host. This is especially dangerous in environments where service accounts, CI/CD runners, and admin jump hosts already hold elevated privileges.
NHI Management Group research shows that 97% of NHIs carry excessive privileges, which makes any uncontrolled forwarding path more consequential because one exposed session can reach far beyond its intended scope. The same body of research also shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, underscoring how session abuse and secret misuse often converge. SSH forwarding should therefore be reviewed alongside Ultimate Guide to NHIs guidance on lifecycle control, visibility, and least privilege, and against identity governance expectations in NIST Cybersecurity Framework 2.0.
Organisations typically encounter the blast radius of SSH forwarding only after a bastion compromise, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Forwarding can extend privileged access beyond intended scope and amplify session misuse risk. |
| NIST CSF 2.0 | PR.AC-4 | Session forwarding affects how least privilege is applied across protected access paths. |
| NIST Zero Trust (SP 800-207) | AC-4 | SSH forwarding can bypass direct network assumptions unless traffic control is enforced per session. |
| NIST SP 800-63 | IAL2 | High-assurance identity checks support stronger approval for privileged remote session use. |
| CSA MAESTRO | IA-1 | Agentic and automated access paths need explicit control over tunnel creation and downstream trust. |
Require stronger identity proofing and operator verification before enabling tunneled administrative access.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
