iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you need to SSH from your laptop to a private host through a bastion, use OpenSSH’s ProxyJump rather than enabling agent forwarding on the bastion. ProxyJump makes the bastion a connection relay: your client connects to the jump host and asks it to forward TCP traffic to the final host. Agent forwarding is different because it exposes a path to your local authentication agent on the remote system.
Forwarding does not copy your private-key material to the bastion. However, a user who can bypass permissions on the forwarded agent socket can use identities loaded in your local agent to authenticate elsewhere. OpenSSH therefore defaults ForwardAgent to no and warns that “Agent forwarding should be enabled with caution.” OpenBSD’s ssh_config(5) manual documents both behaviors.
Is SSH agent forwarding safe?
It is safer to leave agent forwarding disabled unless a specific workflow requires it. The risk is not that the bastion can read your private-key file; the risk is that someone who gains the required access to the forwarded agent socket can ask your still-running local agent to perform authentication operations.
Recommended Free Tools
ForwardAgent controls whether the connection to your authentication agent is forwarded to the remote machine, and its default value is no. If forwarding is turned on, the protection of the agent socket on the remote host becomes part of your security boundary. A compromise of the bastion, a privileged account there, or a user able to bypass socket permissions can therefore turn your agent into an authentication service for the attacker.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The practical distinction matters:
- Private-key extraction: the forwarded agent does not hand over the key material itself.
- Authentication use: an attacker with access to the forwarded socket can request signatures or other operations that authenticate with identities currently loaded in your agent.
- Exposure duration: the opportunity lasts while the forwarded connection and the relevant identities remain available.
That is why forwarding is a deliberate exception, not a convenient default. A bastion should normally relay your SSH connection without receiving access to the agent behind it.
What does agent forwarding expose on the bastion?
When forwarding is enabled, the SSH client arranges for the remote session to reach a socket representing your local authentication agent. The socket is not a copy of your key file; it is an interface through which authentication requests can be sent.
- Your laptop has an authentication agent with one or more identities loaded.
- You connect to the bastion with agent forwarding enabled, either through configuration or an option such as
-A. - The remote session receives access to a forwarded Unix-domain socket that represents the local agent connection.
- Anyone who can bypass the socket’s permissions can submit authentication operations through that connection.
- The agent may approve those operations according to its normal policy, allowing authentication with the loaded identities.
The attacker still does not receive a readable private-key blob from the agent. That limits one class of theft, but it does not make the forwarding path harmless: the attacker can use the identities for logins or other SSH authentication while the agent permits the requests. The OpenBSD manual describes this exact distinction and its permission caveat. See the ForwardAgent description in ssh_config(5).
Why does ProxyJump avoid this particular exposure?
ProxyJump changes the route, not the trust model of your keys. The client first connects to the named jump host, then establishes TCP forwarding from that host to the ultimate destination. The bastion carries encrypted connection traffic; it does not need a forwarded socket to your local agent merely to relay the session.
For a single bastion, the conceptual path is:
your laptop → bastion → private host
Your SSH client still performs host and user authentication for the destination. ProxyJump does not promise immunity from every SSH threat: the bastion can still be attacked, host keys can be wrong or unverified, client configuration can be unsafe, and the destination server can be compromised. Its advantage here is narrower and concrete: reaching the private host does not require exposing your local agent interface on the bastion.
OpenSSH also permits a sequence of jump proxies, so the same mechanism can construct a multi-hop route when network segmentation requires more than one intermediary. The OpenBSD ssh_config(5) manual documents ProxyJump and its jump-proxy behavior.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How do I configure ProxyJump through a bastion?
Create a host entry for the bastion and a separate entry for the internal destination. Replace the example names, address, and user with values from your environment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Host bastion
HostName bastion.example.net
User alice
Host private-host
HostName 10.0.0.15
User alice
ProxyJump bastionThen connect using the destination alias:
ssh private-hostThis keeps the command short while making the route explicit in your user SSH configuration, normally ~/.ssh/config. A reliable setup process is:
- Confirm direct bastion access. Test
ssh bastionfirst. Resolve its hostname, verify its host key through your normal trust process, and make sure the account is allowed to log in. - Confirm the bastion can reach the private address. The jump host must have network connectivity to
10.0.0.15on the SSH service port. ProxyJump does not create a route that the bastion’s firewall lacks. - Add the destination stanza. Set the destination’s actual
HostNameandUser, then addProxyJump bastion. - Connect by alias. Run
ssh private-host. The client opens the bastion connection and uses it to forward the destination TCP connection. - Verify the destination host key. The final server still has its own host key. Check the name and fingerprint shown by SSH rather than assuming that a trusted bastion automatically proves the destination’s identity.
You can also specify a jump directly for a one-off connection with the client’s -J option, for example ssh -J bastion private-host. Keeping a stable route in the configuration is usually easier to audit and less prone to typing errors.
How should the bastion and destination entries be written?
Use separate Host stanzas whenever the bastion needs its own hostname, user, port, identity, or other client setting. OpenBSD notes that configuration for the destination is generally not applied to jump hosts, so a destination entry should not be expected to supply the bastion’s settings.
For example, if the bastion uses a different account or port, specify those values in its own stanza:
Host bastion
HostName bastion.example.net
User gateway-account
Port 2222
Host private-host
HostName 10.0.0.15
User alice
ProxyJump bastionThe destination’s User alice applies to the private host. The bastion’s User gateway-account and Port 2222 apply only to the first connection. Separating them prevents an accidental assumption that one host’s identity or port is inherited by the other. OpenBSD’s ProxyJump documentation describes this configuration responsibility.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
What is the difference between agent forwarding and ProxyJump?
Both can help you reach a host that is not directly accessible, but they solve different problems. Agent forwarding gives a remote system a route to your local authentication agent; ProxyJump gives your SSH client a network path through a jump host.
| Comparison | Agent forwarding | ProxyJump |
|---|---|---|
| What is made available remotely | Access to a forwarded socket representing the local authentication agent | A TCP-forwarded connection from the jump host to the ultimate target |
| What a user who bypasses socket permissions can do | Use loaded identities for authentication operations, but not extract key material | Observe or interfere with the bastion’s role in the connection; no agent socket is required by the route itself |
| Default posture | ForwardAgent defaults to no |
Enabled per destination with ProxyJump or -J |
| Configuration responsibility | The remote host receives the forwarded-agent interface when enabled | The bastion may need its own Host stanza because destination settings generally do not apply to jump hosts |
| Best fit | A narrowly justified workflow in which a remote system must authenticate onward with your agent | Routine access to an internal host through a bastion without giving the bastion agent access |
The comparison is not a claim that ProxyJump makes a bastion trustworthy. It identifies which capability you are granting: a relay path versus an authentication interface.
How do I keep accidental agent forwarding turned off?
Make the safe default explicit in your client configuration, then enable forwarding only in a narrowly scoped host entry if you have a documented need.
Host *
ForwardAgent noAfter adding a destination-specific ProxyJump entry, do not add ForwardAgent yes merely because the destination is private. ProxyJump does not require agent forwarding. For a one-time connection where you want to override an inherited setting, use an explicit option such as ssh -o ForwardAgent=no private-host.
Review layered configuration when behavior is surprising. System-wide settings, included files, and user entries can all affect the effective options. Check the host patterns that match the destination and bastion separately, and remove broad forwarding rules that were added for an old workflow. Keep only the identities you need in your local agent, and unload them when the work is complete; reducing the loaded set limits what any agent consumer could use.
When is forwarding an acceptable exception?
Forwarding can be justified when a remote session genuinely must use an identity from your local agent to authenticate to a second service, and the intermediary is a host you explicitly trust for that purpose. It should be an intentional exception with a defined start and end, not a blanket setting for every host.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Scope
ForwardAgent yesto the smallest possibleHostpattern rather than placing it underHost *. - Use a dedicated agent or a limited identity set for that task instead of exposing every key you normally carry.
- Remove the exception when the workflow ends and close the forwarded session.
- Treat the intermediary as able to use the loaded identities for authentication while the forwarding channel is active, even though it cannot read the private-key material.
If the remote task only requires reaching an internal SSH server, choose ProxyJump and leave forwarding disabled. That design removes an unnecessary capability instead of asking the bastion’s permissions to protect it.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I troubleshoot a ProxyJump connection?
Diagnose the two network legs separately: your client to the bastion, and the bastion to the destination.
The bastion connection fails immediately
Run ssh bastion by itself. Check its hostname, port, account, network policy, and host-key prompt. If that direct login fails, fix the first leg before changing the destination stanza.
The bastion works but the private host is unreachable
Confirm that the bastion can resolve or route to the destination address and that its firewall permits the destination SSH port. A successful login to the bastion does not prove that the second leg is allowed.
The wrong account or port is used
Put the bastion’s account and port under Host bastion, and the destination’s account and port under Host private-host. Do not rely on destination settings being inherited by the jump host; OpenBSD specifically warns that they generally are not.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsYou receive an unfamiliar host-key warning
Check whether the warning is for the bastion or the final destination, then verify the corresponding host key through your organization’s trusted channel. Do not suppress verification simply because the connection uses a jump host.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
You need more diagnostic detail
Use verbose SSH output, such as ssh -vvv private-host, and identify whether failure occurs while opening the bastion session, creating the TCP forward, or authenticating to the destination. Keep the output private: it can contain hostnames, usernames, and configuration details.
What security responsibilities remain with ProxyJump?
ProxyJump removes the forwarded-agent socket from this access pattern, but it does not authenticate the bastion or destination for you. You still need accurate host keys, appropriately protected client credentials, least-privilege accounts, and a bastion that is patched, monitored, and restricted to its intended role.
Remember that the jump host can affect availability and can observe connection metadata available to it. The final SSH session remains dependent on the destination server’s configuration and on your client’s verification of that server. Use ProxyJump because it grants the bastion the narrower capability required to relay traffic, not because it eliminates every risk associated with an intermediate host.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFrequently Asked Questions
Does ProxyJump copy my private key to the bastion?
No. ProxyJump establishes a connection through the jump host; it does not upload your private-key file. Your client still performs authentication using its configured method, while the bastion supplies the network path to the destination.
Can I use a different username or port for each jump host?
Yes. Give each jump host its own configuration entry, or specify the appropriate user and port in the jump specification. This is especially important in multi-hop routes where gateway accounts and SSH ports differ.
How can I see the effective SSH settings for a destination?
Run ssh -G private-host and inspect the resolved options, including proxy and agent-forwarding settings. This helps reveal an inherited setting from an included file before you open a session.
Will my SSH agent still work for the final host when I use ProxyJump?
Your client can still use its local agent to authenticate the destination without forwarding that agent into the bastion session. The distinction is where the agent is consumed: locally by your client, rather than remotely through a socket exposed on the intermediary.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
