My scenario:

localhost: contains my private key
serverA: contains my public key
serverB: contains my public key

I login to serverA and perform some operations, which involve copying some files from serverB. Since I login with a common username, I don't want to have my private key stored in the serverA. This means, in the ideal situation, I would be able to send my private key only through the ssh session and make it available just as ssh-agent does, so then I connect from serverA to the serverB, my private key is read from memory and used to authenticate to serverB. Is this possible?

1 Answer 1


Yes, that's what the ssh -A flags does.

This only works with keys already added to a running ssh-agent on your local machine. If you have to enter your passphrase when you connect to serverA (or just use a passphrase-free key) then this isn't going to work

From the man page:

Enables forwarding of the authentication agent connection. This can also be specified on a per-host basis in a configuration file.

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.

Disables forwarding of the authentication agent connection.

You might want to pay attention to the warning in the quote though. -A does not expose your key, but it does allow anybody with read/write access to the ssh-agent socket on the server to use your credentials, if they know where to look for the socket. Since you log in using a common user then anybody else with access to that user can get access to your agent.

I think the SSH_AUTH_SOCK on the server just forwards traffic direct to the ssh-agent running on your local machine.

  • I have to confess I tried it, but only by giving my passpharse while connecting. Then I realised I had to setup the ssh agent so that a socket could be established (the key itself isn't forwarded). Apr 7, 2016 at 13:09
  • Good point. I updated the answer
    – ams
    Apr 7, 2016 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.