In such an environment you should be using Kerberos. Then you won't need agent forwarding, and you can maintain security.
I would argue that in such an environment you really should be using LDAP+Kerberos, but if you think LDAP is too much effort (it really isn't), plain Kerberos is comparatively trivial to administer, and adding Kerberos (unlike LDAP) doesn't really require any significant changes to your environment.
Comments
In such an environment you should be using Kerberos. Then you won't need agent forwarding, and you can maintain security.
I would argue that in such an environment you really should be using LDAP+Kerberos, but if you think LDAP is too much effort (it really isn't), plain Kerberos is comparatively trivial to administer, and adding Kerberos (unlike LDAP) doesn't really require any significant changes to your environment.
Why is Kerberos ticket forwarding better than agent forwarding? Either way, root (or a bad .bashrc) can use your credentials while you're logged in.
Sorry. You are absolutely right. Long day...
I disable Kerberos ticket forwarding here, for this exact same reason. But then you don't have ticket forwarding! I don't know what I was thinking.
How does LDAP solve the problem?
We use LDAP to manage public keys for each user, but they still need to supply a private key at some point.
I was talking about Kerberos, not LDAP. However, that's still not right, see parallel comment.