SSH Agent Restriction (new in OpenSSH 8.9)
My need for agent forwarding has almost completely vanished since `ProxyJump` was added a few years ago.<p><pre><code>  Host *.example.com
    User runlevel1
    IdentityFile ~/.ssh/id_rsa-foo
    ProxyJump foo@jump.example.com
</code></pre>
So when I SSH to <i>qux.example.com</i>, it first SSHs to <i>foo@jump.example.com</i> then through it to <i>runlevel1@qux.example.com</i> and my agent is used on each individually.<p>So there's no ssh-agent socket on the intermediate jump box.<p>EDIT: More examples here: <a href="https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_Jump_Hosts" rel="nofollow">https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Proxies_and_J...</a><p>EDIT2: For folks stuck on older SSH clients, you can do this with `ProxyCommand ssh -W ...` instead (also shown in the previous link) which is actually what ProxyJump is doing under-the-hood anyhow. <a href="https://github.com/openssh/openssh-portable/blob/d9dbb5d/ssh.c#L1233" rel="nofollow">https://github.com/openssh/openssh-portable/blob/d9dbb5d/ssh...</a>