SSH agent

Don’t enable agent forwarding on untrusted hosts. The default should be ForwardAgent no in ~/ssh/config.

$ eval "$(ssh-agent -s)"
Agent pid 27413
$ ssh-add -t 10h ~/.ssh/id_ed25519-example.com
Identity added: /home/abr/.ssh/id_ed25519-example.com (/home/abr/.ssh/id_ed25519-example.com)
Lifetime set to 36000 seconds
$ 

SSH kerberos

Verify kerberos authentication

$ ssh -o PasswordAuthentication=no -o PubkeyAuthentication=no -o GSSAPIAuthentication=yes internal-host.example.com

Jumphost

Requires OpenSSH 7.3 (released on 2016-08-01)

SSH

$ ssh -J jumphost.example.com internal-host.example.com

SCP

$ scp -o 'ProxyJump jumphost.example.com' file.txt internal-host.example.com:/directory

rsync

$ rsync -e 'ssh -J jumphost.example.com' directory/ internal-host.example.com:/directory/