>> Date: Wed, 1 Apr 2026 16:20:30 +0200
>> From: Didier Kryn<kryn@???>
>> Subject: Re: [DNG] Using ssh-agent in multiple logins
>>   ? ? I admit my config is not the most secure, particularly concerning
>> the last point, but nowadays I essentialy use ssh within my home LAN --
>> with exceptions for git clone and git push. Nevertheless it is a simple
>> starting point.
>>
>>   ? ? I, personally, would need a more literary and detailed explanation
>> to understand your inner, outer and bastion configuration.
>>
>> --? ? ?Didier
>
> I used this configuration, taught it (or tried to teach it) to my 
> networking classes on virtual machines.  Just re-verified it on my 
> home LAN.
>
> Scenario: I'm on client "whiteknight".  SSH server / primary login 
> target, is "rpi500".  Secondary servers are "whitequeen" and "rpi3".  
> All running Devuan except rpi3 which is running RaspiOS.
>
>   * Server: set  "X11Forwarding yes"  in "/etc/ssh/sshd_config".
>
>   * whiteknight client:  "~/.ssh/config"  includes sections for the
>     server and the secondary targets, like this:
>  *
>>     Host whitequeen
>>      HostName whitequeen
>>      User bobmon
>>      Port 22
>>      Protocol 2
>>      ForwardX11 yes
>>     #
>>     # forward to rpi500tunnel...
>>      LocalForward 22001 rpi500:22
>>     #
>>     # forward to rpi3tunnel...
>>      LocalForward 22003 rpi3:22
>>     #
>>
>>     Host rpi500tunnel
>>      HostName localhost
>>      User bobmon
>>      Port 22001
>>      Protocol 2
>>      ForwardX11 yes
>>
>>     Host rpi3tunnel
>>      HostName localhost
>>      User bobmon
>>      Port 22003
>>      Protocol 2
>>      ForwardX11 yes
>>
>   * Usage: the client needs two (or more) sessions, one for an initial
>     session that will do the forwarding, plus as many sessions
>      1. Client (whiteknight) sshes into server (whitequeen).  This
>         creates the "tunnel".
>      2. The ssh session needs to be backgrounded, or another terminal
>         shell opened, for the next step.
>      3. Whiteknight may now ssh into "rpi3tunnel".  This is port 22003
>         on "localhost", which is monitored by the process running the
>         current ssh session.  The new session request is forwarded by
>         the "whitequeen" server to the "rpi3" server (which used to be
>         behind a firewall and inaccessible from my home). 
>         "rpi500tunnel" works the same way.
>
> This all works better if you do "passwordless ssh" using 
> authentication keys, otherwise you'll be typing passwords repeatedly.
>
> HTH, -Bob
>
>