Thank you. I have further question. When I am on server,primary.bastion.wmflabs.org ,I found "ssh -A firstname.lastname@example.org" (I have set ssh ForwardAgent yes ) failed. It says "Permission denied (publickey)"
I read logs of ids.mw-extension-ids.eqiad.wmflabs project on https://horizon.wikimedia.org/project/ I see some "root@ids" .
Does it means there is only root on ids.mw-extension-ids.eqiad.wmflabs now?
You shouldn't use agent forwarding, you need to "ssh email@example.com" on your own computer and have it set up to proxy via bastion.wmflabs.org in your ~/.ssh/config file, see https://wikitech.wikimedia.org/wiki/Help:Access#Accessing_instances_with_ProxyCommand_ssh_option_.28recommended.29