If you use ProxyJump (-J) you don't forward the agent off of host A and it works with completely arbitrary chains (A->B->C->D->E->F->...)
replyExcept that's not really the network path that's going on, right? If I am on A and connect to B and then want to use the network to transfer a bunch of data from B to C over an ssh channel between them, using ProxyJump brings it all back to the bastion box. And if A is in the US and B & C are in Europe connected with a 40 GB LAN, using proxyjump will bring the connection from B->C into Europe->US->Europe. How do I do this with my credentials existing on A being used to log in to B and then the same credentials being used to connect from B to C while only having the one network connection is B->C and not to my bastion host?
replyIf you're using -sk keys (i.e. setup via FIDO2 on the Yubikey like the article, not PIV) yes you can forward the keys loaded into your agent like normal, with ssh -A.
replyPIV keys can also be forwarded through an agent. The only thing to be aware of is that the agent process will effectively cache your PIN if you do this.
replyssh-add -s <pkcs11.so>
To mitigate that you can add -c to the ssh-add command. That will make the agent prompt for confirmation (on the host with the PIV key) every time something asks to use it. Doesn't quite get you the same security as just not caching the PIN to start with but it's OK.
Thanks to both you and the other person who replied. I appreciate the education.
reply