7. Forwarding Access to an Agent

Agent access may be forwarded over an SSH connection using [RFC4254]. Support may be advertised with agent-forward in SSH_MSG_EXT_INFO. Many deployed implementations use the pre-standardization names auth-agent-req@openssh.com and auth-agent@openssh.com.

A client requests forwarding with a channel request named agent-req or auth-agent-req@openssh.com. The server opens agent connections using channel type agent-connect or auth-agent@openssh.com. SSH clients SHOULD handle multiple concurrent forwarded connections and MUST refuse unauthorized agent connection requests.