As you mentioned, the environment variables are removed by
sudo, for security reasons.
sudo is quite configurable: you can tell it precisely which environment variables you want to keep thanks to the
env_keep configuration option in
For agent forwarding, you need to keep the
SSH_AUTH_SOCK environment variable. To do so, simply edit your
/etc/sudoers configuration file (always using
visudo) and set the
env_keep option to the appropriate users. If you want this option to be set for all users, use the
Defaults line like this:
man sudoers for more details.
You should now be able to do something like this (provided
user1's public key is present in
/etc/sudoers file is setup as indicated above):
user1@mymachine> eval `ssh-agent` # starts ssh-agent
user1@mymachine> ssh-add # add user1's key to agent (requires pwd)
user1@mymachine> ssh -A serverA # no pwd required + agent forwarding activated
user1@serverA> sudo su - user2 # sudo keeps agent forwarding active :-)
user2@serverA> ssh serverB # goto user2@serverB w/o typing pwd again...
user2@serverB> # ...because forwarding still works