First, turn off password and root ssh logins to your machine. Treat all the other machines on the LAN as if they have already been suborned. Don't 'ssh -A' to t

First, turn off password and root ssh logins to your machine. Treat all the other machines on the LAN as if they have already been suborned. Don't 'ssh -A' to them if it would enable them to log back into your machine. No 'ssh -X' either except from within a VM on your machine, with its own X-in-a-window. I.e., pretend every other machine is out on the open internet. There are new ssh options to keep closer control of credentials.