title: How to disable ssh-agent forwarding
body: <p>ssh-agent forwarding can be accomplished with <code>ssh -A ...</code>. </p>
  
  <p>Most references I have found state that the local machine must configure <code>~/.ssh/config</code> to enable AgentForwarding with the following code:</p>
  
  <pre><code>Host &lt;trusted_ip&gt;
    ForwardAgent yes
  
  Host *
    ForwardAgent no
  </code></pre>
  
  <p>However, with this configuration, I am still able to see my local machines keys when tunneling into a remote machine, with <code>ssh -A user@remote_not_trusted_ip</code>, and running <code>ssh-add -l</code>.</p>
  
  <p>From the configuration presented above, I would expect that the ssh-agent forwarding would fail and the keys of the local machine would not be listed by <code>ssh-add -l</code>. </p>
  
  <p>Why is the machine <code>@remote_not_trusted_ip</code> able to access the ssh-agent forwarded keys even though the <code>~/.ssh/config</code> file states the following?</p>
  
  <pre><code>Host *
    ForwardAgent no
  </code></pre>
  
  <p>How can i prevent ssh-agent from forwarding keys to machines not explicitly defined in the <code>~/.ssh/config</code>?</p>