Whenever you leave a computer while SSH clients are running, lock the computer’s display with a password-protected screen locker. This is particularly important if you’re running an agent that permits an intruder to access your remote accounts without a passphrase.

In your client configuration file, turn on some safety features as mandatory values:

    # OpenSSH
    # Put at the top of your configuration file
    Host *
      GatewayPorts no
      StrictHostKeyChecking ask
     ForwardX11Trusted no

    # Tectia
    # Put at the bottom of your configuration file
    *:
     GatewayPorts no
     StrictHostKeyChecking ask
     TrustX11Applications no

The GatewayPorts value forbids remote clients from connecting to locally forwarded ports. Finally, rather than blindly connect, the StrictHostKeyChecking value warns you of any changed host keys and asks what you want to do. For X11 forwarding we elect to generate a new, untrusted xauth key rather than inherit the trust already in effect. [9.4.5.3]