Oh, I didn't know about the -J option. At $WORK, after ssh-ing onto the jump host, we've to do 'sudo -u special_user sudosh' (no password) before we ssh further. I don't suppose there's any way around that, is there?