Disable agent forwarding

nixos/modules/ssh.nix

@@ -37,6 +37,10 @@
         # password-based authentication at all.
         PermitEmptyPasswords no
 
+        # Agent forwarding is fraught.  It can be used by an attacker to
+        # leverage one compromised system into more.  Discourage its use.
+        AllowAgentForwarding no
+
         # Only allow authentication as one of the configured users, not random
         # other (often system-managed) users.  Possibly this is also
         # superfluous!  NixOS system users have nologin as their shell ... so they