[upon_drumhead]

Or even better, use ProxyJump and don’t forward your agent at all :)

[aarmenaa]

I'm moving towards this for my current workplace. SSH will only be allowed via VPN, only to a bastion, and that bastion will not permit agent forwarding, or really much of anything other than ProxyJump. I'm baffled that agent forwarding is a feature when OpenSSH won't even use a key file if the permissions are wrong.

[lxgr]

Agent forwarding has its uses; not all of them can be replaced by ProxyJump.

[GauntletWizard]

I never need to SSH directly into servers. When I do, I need to be able to clone private git repos. ssh agent forwarding is the right answer.

[sureglymop]

To go further, use a VPN that uses UDP and only allow that connection after port knocking three randomly chosen ports.

[ThePowerOfFuet]

This is way overkill when you could simply use Wireguard instead.

[sureglymop]

Not really, its just a few lines in your nftables/iptables rules. And sure, wireguard is great. It's just an underrated trick from decades ago. :)