search for: _forward_

Consider this topology domain1-server1 domain2-server2 | | laptop - domain1-server1 ---- domain2-server1 Laptop has two ssh identities, domain1 and domain2. I don't wish to store identity locally in any of the servers. As far as I understand, there isn't any way to limit ssh-agent to allow only signing

I know this is pretty left-field, but I'm working on a custom ssh-agent implementation and looking at ways to detect forwarded agent connections, with the hope to have a "confirm" mode which can apply just to those (or those, plus non-whitelisted local processes). I realise this has been discussed a bit before, but I have thought up a method which seems to be working in my tests