Carry SSH pem keys through a jump host past a hardware/enclave agent (Secretive/Keychain) — override IdentityAgent + forward the ephemeral agent

ssh-carry-pems-through-jump-host.md

SSH: carry pems through a jump host (past a hardware/enclave agent)

The problem

Two SSH agents exist and they never meet:

• ssh-add writes to your agent ($SSH_AUTH_SOCK).
• ssh reads the enclave agent (forced by Host * → IdentityAgent in ~/.ssh/config).

So keys you add never get offered. Override the agent for the connection and you're fine.

Steps

# 1. spin an ephemeral agent, load pems
ssh-agent bash
ssh-add ~/.ssh/*.pem
ssh-add -L                    # verify pems are here
 
# 2. hop to jump — override enclave agent, forward THIS agent
ssh -A -o IdentityAgent="$SSH_AUTH_SOCK" USER@JUMP_HOST
 
# 3. on jump: pems are here, hop onward
ssh-add -L                    # should show pems, not the enclave key
ssh USER@INTERNAL_IP
 
# exit twice = back to laptop, ephemeral agent dies with keys

Why each flag

• -o IdentityAgent="$SSH_AUTH_SOCK" → make ssh use your agent, not the enclave one. This alone fixes login.
• -A → forward that agent onward so pems are available on the jump box for the next hop.