This is nice but the agent forwarding is a legitimate concern especially because a compromised host can take off with the private keys which are used while beginning the session. Most  private keys are used for more than connecting to a single host.<p>In our setup we use jailkit allowing only ssh passthrough [1], we have added LDAP support to it (may release the patch later).<p>[1] <a href="http:&#x2F;&#x2F;olivier.sessink.nl&#x2F;jailkit&#x2F;howtos_ssh_only.html" rel="nofollow">http:&#x2F;&#x2F;olivier.sessink.nl&#x2F;jailkit&#x2F;howtos_ssh_only.html</a>