3 ms·

You don't need agent forwarding for that. Just use ssh's dumb tcp forwarding and keep your agent on your local host. Ex.: Host bastion.company ProxyC

• mentat 11y ago
  Because enabling tcp forwarding is so much more safe on a jump box? That's just asking for another pile of unauditable trouble.
  • creshal 11y ago
    Safer than dumping all your private keys onto the jump box and using that to validate the final target? Why yes. This way, your local ssh client validates the final target public key, not the jump box.
    • mentat 11y ago
      The whole point of agent forwarding is that you don't have to place your keys on the jump box. With -c for per use confirmation it seems much more secure.
      • creshal 11y ago
        > The whole point of agent forwarding is that you don't have to place your keys on the jump box. A socket that allows dumping the keys isn't really an improvement. If the box is compromised, agent forwarding can still be abused. > seems much more secure. Emphasis on "seems".