Thanks for the tip, it inspired me to do the following: user@host3# ssh-keygen -t rsa -f ~/.ssh/id_rsa_hopping user@host3# echo command=\"nc host2 22\" `cat ~

Thanks for the tip, it inspired me to do the following: user@host3# ssh-keygen -t rsa -f ~/.ssh/id_rsa_hopping user@host3# echo command=\"nc host2 22\" `cat ~/.ssh/id_rsa_hopping.pub` | ssh user@host1 "cat >> ~/.ssh/authorized_keys" user@host3# scp ~/.ssh/id_rsa_hopping* user@host4:~/.ssh/ The point of all of this being that host4 should be able to do anything on host2, but only be able to use host1 as a hop: user@host4# ssh -oProxyCommand="ssh -i ~/.ssh/id_rsa_hopping host1" host2