Checking environment for
SSH_AUTH_SOCK is good for direct ssh connections.
If you use proxies (
proxy_command) you might have a connction that looks like:
If agent forwarding is active on all those hosts, then
SSH_AUTH_SOCK will be set and "contains" your ssh key from
local on all hosts.
Now suppose agent forwarding is disabled on
hostB but enabled on
SSH_AUTH_SOCK will be set on
hostD but it will actually be "empty". Of course the agent is forwarded but only from
hostD. The chain is broken.
Now to check if actually the key is available on
hostD you can simply call
ssh-add. It will exit with code 1 in any case, but if the key is unavailable it will show this on
Could not open a connection to your authentication agent.
So you can check for the
SSH_AUTH_SOCK plus make sure
ssh_add has no output.