code: func (s *Server) newRemoteClient(systemLogin string) (*ssh.Client, error) {
  	// the proxy will use the agent that has been forwarded to it as the auth
  	// method when connecting to the remote host
  	if s.userAgent == nil {
  		return nil, trace.AccessDenied("agent must be forwarded to proxy")
  	}
  	authMethod := ssh.PublicKeysCallback(s.userAgent.Signers)
  
  	clientConfig := &ssh.ClientConfig{
  		User: systemLogin,
  		Auth: []ssh.AuthMethod{
  			authMethod,
  		},
  		HostKeyCallback: s.authHandlers.HostKeyAuth,
  		Timeout:         defaults.DefaultDialTimeout,
  	}
  
  	// Ciphers, KEX, and MACs preferences are honored by both the in-memory
  	// server as well as the client in the connection to the target node.
  	clientConfig.Ciphers = s.ciphers
  	clientConfig.KeyExchanges = s.kexAlgorithms
  	clientConfig.MACs = s.macAlgorithms
  
  	dstAddr := s.targetConn.RemoteAddr().String()
  	client, err := proxy.NewClientConnWithDeadline(s.targetConn, dstAddr, clientConfig)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return client, nil
  }
docs: // newRemoteSession will create and return a *ssh.Client and *ssh.Session
  // with a remote host.