Yes, that's what the
ssh -A flags does.
This only works with keys already added to a running
ssh-agent on your local machine. If you have to enter your passphrase when you connect to
serverA (or just use a passphrase-free key) then this isn't going to work
From the man page:
Enables forwarding of the authentication agent connection. This can also be specified on a per-host basis in a configuration file.
Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.
Disables forwarding of the authentication agent connection.
You might want to pay attention to the warning in the quote though.
-A does not expose your key, but it does allow anybody with read/write access to the ssh-agent socket on the server to use your credentials, if they know where to look for the socket. Since you log in using a common user then anybody else with access to that user can get access to your agent.
I think the
SSH_AUTH_SOCK on the server just forwards traffic direct to the ssh-agent running on your local machine.