Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Like a good and secure little citizen, I have keychain --clear in my .zlogin file. However, I have 2-3 systems that a routinely access. Now, through my ssh config, I have forwarding agent set up. So I might connect from A->B->C. Now, both B and C have the same authorized_keys file.

Here's what I envision working (or something like it):

Let's say I make a password connection to B. It should drop any previous keys and ask me for the new password. Then I ssh from there to C. Now C drops its keys, but since I'm using forwarding, C should be using the keys from B. So I finish my work on C and log out, but it should keep the keys forwarded from B. So it might look something like this:

Host  ->   Key
B     ->   B
C     ->   B

Later on, I'm working on host A and I connect to B (with agent forwarding, of course). So now I've got:

A     ->   A
B     ->   A
C     ->   B

Then I go ahead and ssh to C. Now all three servers should be using the same key. And when I exit all the way out, they should all be using the same key.

Is this possible? And if so how can I do it? And if this isn't terribly secure, what would make for a better method?

share|improve this question
What would make for a better method depends on what you wish to accomplish by this method. What is the goal? – MarkusDBX Mar 2 '13 at 4:39
The goal is to stop having to unlock my keys on my other machines - I'm perfectly happy with them storing the forwarded agent key after I log out. – Wayne Werner Mar 3 '13 at 1:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.