The particularly annoying part is that nc or socat or whatever is not required in any relatively modern ssh. My .ssh/config for use with a bastion or jump host

The particularly annoying part is that nc or socat or whatever is not required in any relatively modern ssh. My .ssh/config for use with a bastion or jump host: Host *.prod.blah.com ForwardAgent yes ProxyCommand ssh -W %h:%p %r@jumphost.ext.blah.com Host *.ext.blah.com ForwardAgent yes It's all do-able within ssh-land. I do forward my agent, but only to hosts in my production sub-domains rather than to anyone I connect to. It could get hijacked, but at least the attack vector is a lot smaller.