·8 min read

SSH Agent Forwarding: Secure Key Management Across Servers

Learn how to use SSH agent forwarding to authenticate across multiple servers without copying private keys. Secure, convenient, and enterprise-ready.

SSHSecurityAuthenticationDevOpsBest Practices

SSH agent forwarding lets you authenticate to remote servers using your local SSH keys, without ever copying private keys to intermediate hosts. It's a powerful feature for managing complex infrastructure securely.

The Problem: Key Proliferation

When managing multiple servers, you face a choice:

Option 1: Copy your private key to each server

  • ❌ Security risk: private key exposed on multiple systems
  • ❌ Key management nightmare: revoke on all servers if compromised
  • ❌ Audit difficulty: can't track which key was used where

Option 2: Create separate keys for each server

  • ❌ Key explosion: hundreds of keys to manage
  • ❌ Configuration complexity: which key for which server?
  • ❌ Rotation overhead: update everywhere when keys expire

Option 3: SSH Agent Forwarding

  • ✅ Single key on your local machine
  • ✅ Keys never leave your device
  • ✅ Centralized key management
  • ✅ Easy revocation

How SSH Agent Forwarding Works

┌─────────────┐         ┌─────────────┐         ┌─────────────┐
│  Your Mac   │────────▶│  Server A   │────────▶│  Server B   │
│  (SSH Key)  │  SSH    │  (No key)   │  SSH    │  (No key)   │
│  SSH Agent  │◀────────│  Forward    │◀────────│  Forward    │
└─────────────┘  Agent  └─────────────┘  Agent  └─────────────┘
  1. Your local SSH agent holds your private key
  2. You SSH to Server A with agent forwarding enabled
  3. Server A can use your key to authenticate to Server B
  4. Your private key never leaves your Mac

Enabling Agent Forwarding

Method 1: Command Line

ssh -A user@server-a
# Now from server-a, you can SSH to server-b using your local key
ssh user@server-b

The -A flag enables agent forwarding.

Method 2: SSH Config (Recommended)

# ~/.ssh/config
Host server-a
    HostName server-a.example.com
    User admin
    ForwardAgent yes

Host server-b
    HostName server-b.example.com
    User admin
    ProxyJump server-a
    ForwardAgent yes

Now just ssh server-a and agent forwarding is automatic.

Method 3: Global Default

# ~/.ssh/config
Host *
    ForwardAgent yes

⚠️ Security warning: Only enable globally if you trust all servers you connect to.

Security Considerations

Agent forwarding is powerful but requires trust:

The Risk

When you enable agent forwarding to a server, that server's root user can:

  • Use your SSH agent to authenticate to other servers
  • Impersonate you on any system where your key is authorized

Mitigation Strategies

1. Only forward to trusted servers

# Good: Forward to your own infrastructure
Host myserver.com
    ForwardAgent yes

# Bad: Forward to shared/untrusted systems
Host public-shell.example.com
    ForwardAgent no  # Explicitly disable

2. Use ProxyJump instead when possible

# Instead of forwarding through server-a to reach server-b
Host server-b
    ProxyJump server-a

ProxyJump creates a direct tunnel without exposing your agent to the intermediate host.

3. Restrict agent forwarding scope

# Only allow specific keys to be forwarded
Host server-a
    ForwardAgent yes
    IdentityFile ~/.ssh/work_id_ed25519
    IdentitiesOnly yes

Practical Use Cases

Use Case 1: Bastion Host to Private Servers

# Your Mac → Bastion → Private Server
ssh -A bastion.example.com
ssh internal-server  # Uses your local key

Use Case 2: CI/CD Deployments

# Deploy to multiple servers through a gateway
ssh -A deploy-gateway
for server in web1 web2 web3; do
    ssh $server 'cd /app && git pull && systemctl restart app'
done

Use Case 3: Git Operations on Remote Servers

# Clone private repos on remote server using your local SSH key
ssh -A server
git clone git@github.com:company/private-repo.git

Your GitHub SSH key works on the remote server without copying it.

FoxTerm Agent Forwarding Support

FoxTerm makes agent forwarding seamless:

Visual Agent Management

  • See all loaded SSH keys in the connection panel
  • Toggle agent forwarding per connection
  • Monitor which keys are being used

One-Click Forwarding

Enable agent forwarding in the connection settings:

  1. Open connection properties
  2. Check "Enable Agent Forwarding"
  3. Connect — your keys are available on the remote server

Key Selection

Choose which keys to forward:

  • Forward all keys from your Secure Enclave
  • Forward specific keys only
  • Restrict by destination host

Security Indicators

FoxTerm shows clear indicators when agent forwarding is active:

  • 🔒 Lock icon in the status bar
  • List of servers using your agent
  • One-click revoke all forwarding

Advanced: Restricting Forwarded Keys

SSH Agent Constraints

You can restrict which keys are available:

# Load only specific key into agent
ssh-add ~/.ssh/work_id_ed25519

# List loaded keys
ssh-add -l

# Remove all keys
ssh-add -D

Server-Side Restrictions

On the remote server, restrict which keys can be used:

# /etc/ssh/sshd_config on remote server
Match User admin
    AllowAgentForwarding yes
    # But restrict what they can do
    ForceCommand /usr/local/bin/restricted-shell

Troubleshooting

Problem: Agent forwarding not working

Check 1: Is SSH agent running?

echo $SSH_AUTH_SOCK
# Should show a path like /tmp/com.apple.launchd/Listeners

Check 2: Are keys loaded?

ssh-add -l
# Should list your keys

Check 3: Is forwarding enabled?

ssh -G host | grep forwardagent
# Should show "yes"

Problem: Permission denied on remote server

Your key might not be authorized on the target server. Check:

# On remote server
cat ~/.ssh/authorized_keys
# Your public key should be listed

Problem: Agent forwarding works locally but not in scripts

Scripts don't inherit your SSH agent by default. Fix:

# In your script
export SSH_AUTH_SOCK=$(ssh-agent -s | grep SSH_AUTH_SOCK | cut -d= -f2 | cut -d' ' -f1)

Best Practices

  1. Use ProxyJump when possible — Safer than agent forwarding
  2. Forward only to trusted hosts — Never forward to shared systems
  3. Restrict key scope — Use IdentitiesOnly yes in SSH config
  4. Monitor agent usage — Check which servers are using your keys
  5. Rotate keys regularly — Even with forwarding, good hygiene matters
  6. Use separate keys — Different keys for work, personal, and production

Conclusion

SSH agent forwarding is a powerful tool for managing complex infrastructure securely. When used correctly, it eliminates the need to copy private keys across servers while maintaining centralized key management.

FoxTerm makes agent forwarding visual and secure, with clear indicators and granular control over which keys are forwarded where.

FoxTerm Pro includes advanced SSH agent management. Download at foxterm.app.