kaau@OCLT71159526 ~$ echo ${SHELL}
/usr/bin/bash

#
# OCLT71159526 (laptop) --> hctsaccdljmp005 (jumpbox)--> tcacaueslapp003 (EC2):
#
kaau@OCLT71159526 ~$ ls -ld ${HOME}/.ssh
drwxr-xr-x 1 kaau 1049089 0 Aug  7 09:22 /c/Users/kaau/.ssh                                                  ---folder permission should be 0700

kaau@OCLT71159526 ~$ ls -l ${HOME}/.ssh
-rw-r--r-- 1 kaau 1049089 1023 Aug  7 09:22 config
-rw-r--r-- 1 kaau 1049089  411 Feb 14 01:41 id_ed25519                                                       ---SSH key permission should be 0600
-rw-r--r-- 1 kaau 1049089  102 Feb 14 01:41 id_ed25519.pub                                                   ---SSH key permission should be 0600
-rw-r--r-- 1 kaau 1049089 1105 Aug  6 12:23 known_hosts

kaau@OCLT71159526 ~$ cat ${HOME}/.ssh/config
[[blue:Host *.bmogc.net]]
[[blue:  User kaau]]
[[blue:  IdentityFile ~/.ssh/id_ed25519]]
[[blue:  IdentitiesOnly yes]]
[[blue:  StrictHostKeyChecking no]]
[[blue:Host hctsaccdljmp005.hcloud.bmogc.net lnxjmp]]
[[blue:  HostName 10.160.50.84]]
[[blue:Host tcacaueslapp001.devhcloud.bmogc.net tcac001]]
[[blue:  HostName 10.164.93.175]]
[[blue:  # MACs hmac-sha2-256                                                 # requires for RHEL9]]
[[blue:  ProxyCommand ssh hctsaccdljmp005.hcloud.bmogc.net nc %h %p]]
[[blue:Host tcacaueslapp002.devhcloud.bmogc.net tcac002]]
[[blue:  HostName 10.164.93.224]]
[[blue:  # MACs hmac-sha2-256                                                 # requires for RHEL9]]
[[blue:  ProxyCommand ssh hctsaccdljmp005.hcloud.bmogc.net nc %h %p]]
[[blue:Host tcacaueslapp003.devhcloud.bmogc.net tcac003]]
[[blue:  HostName 10.164.93.203]]
[[blue:  # MACs hmac-sha2-256                                                 # requires for RHEL9]]
[[blue:  ProxyCommand ssh hctsaccdljmp005.hcloud.bmogc.net nc %h %p]]

kaau@OCLT71159526 ~$ ssh -vv tcacaueslapp003.devhcloud.bmogc.net "hostname -f"
debug1: OpenSSH_10.2p1, OpenSSL 3.5.5 27 Jan 2026
debug1: Reading configuration data /c/Users/kaau/.ssh/config
debug1: /c/Users/kaau/.ssh/config line 1: Applying options for *.bmogc.net
debug1: /c/Users/kaau/.ssh/config line 20: Applying options for tcacaueslapp003.devhcloud.bmogc.net
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: resolve_canonicalize: hostname 10.164.93.203 is address
debug1: Executing proxy command: exec ssh hctsaccdljmp005.hcloud.bmogc.net nc 10.164.93.203 22
debug1: loaded pubkey from /c/Users/kaau/.ssh/id_ed25519: ED25519 SHA256:H34ywGpx+28qmPbSTp284tIhaLl8rSyZweL3iVfkogU
debug1: identity file /c/Users/kaau/.ssh/id_ed25519 type 2
debug1: no identity pubkey loaded from /c/Users/kaau/.ssh/id_ed25519
debug1: Local version string SSH-2.0-OpenSSH_10.2
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
-------------------------------------
You must be properly authorized to proceed beyond this screen. To proceed without proper authorization may be a criminal offence and may result 
in civil liabilities and/or job-related penalties.
Vous devez disposer d'une autorisation en bonne et due forme pour aller au-dela du present ecran. Sans cette autorisation, vous risquez de commettre 
une infraction criminelle susceptible d'entrainer des responsabilites civiles ou des sanctions professionnelles, ou les deux.
-------------------------------------
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.9
debug1: compat_banner: match: OpenSSH_9.9 pat OpenSSH* compat 0x04000000
debug2: fd 6 setting O_NONBLOCK
debug2: fd 5 setting O_NONBLOCK
debug1: Authenticating to 10.164.93.203:22 as 'kaau'
debug1: load_hostkeys: fopen /c/Users/kaau/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,
rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,
umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,
umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,
diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ext-info-s,kex-strict-s-v00@openssh.com
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
debug2: ciphers stoc: aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
debug2: MACs ctos: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512
debug2: MACs stoc: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: aes128-gcm@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: aes128-gcm@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:OljxRZfexR4SzilJeSAGhyLgXSexo6YFlNq29+rO54k
debug1: load_hostkeys: fopen /c/Users/kaau/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '10.164.93.203' is known and matches the ED25519 host key.
debug1: Found key in /c/Users/kaau/.ssh/known_hosts:3
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: Sending SSH2_MSG_EXT_INFO
debug1: expecting SSH2_MSG_NEWKEYS
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 4294967296 blocks
debug2: KEX algorithms: mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,
diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,
ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,
rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,
sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,
umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_ext_info_client_parse: server-sig-algs=<ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512>
debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=<0>
debug1: kex_ext_info_check_ver: ping@openssh.com=<0>
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
-------------------------------------
You must be properly authorized to proceed beyond this screen. To proceed without proper authorization may be a criminal offence and may result in 
civil liabilities and/or job-related penalties.
Vous devez disposer d'une autorisation en bonne et due forme pour aller au-dela du present ecran. Sans cette autorisation, vous risquez de commettre 
une infraction criminelle susceptible d'entrainer des responsabilites civiles ou des sanctions professionnelles, ou les deux.
-------------------------------------
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_ext_info_client_parse: server-sig-algs=<ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,
ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512>
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password
debug1: Next authentication method: publickey
debug1: Will attempt key: /c/Users/kaau/.ssh/id_ed25519 ED25519 SHA256:H34ywGpx+28qmPbSTp284tIhaLl8rSyZweL3iVfkogU explicit
debug2: pubkey_prepare: done
debug1: Offering public key: /c/Users/kaau/.ssh/id_ed25519 ED25519 SHA256:H34ywGpx+28qmPbSTp284tIhaLl8rSyZweL3iVfkogU explicit
debug2: we sent a publickey packet, wait for reply
debug1: Server accepts key: /c/Users/kaau/.ssh/id_ed25519 ED25519 SHA256:H34ywGpx+28qmPbSTp284tIhaLl8rSyZweL3iVfkogU explicit
Authenticated to 10.164.93.203 (via proxy) using "publickey".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug2: channel 0: send open
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: filesystem
debug2: client_loop: session QoS is now interactive
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: client_input_hostkeys: searching /c/Users/kaau/.ssh/known_hosts for 10.164.93.203 / (none)
debug1: client_input_hostkeys: searching /c/Users/kaau/.ssh/known_hosts2 for 10.164.93.203 / (none)
debug1: client_input_hostkeys: hostkeys file /c/Users/kaau/.ssh/known_hosts2 does not exist
debug1: client_input_hostkeys: no new or deprecated keys from server
debug1: Remote: /home/kaau/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug1: Remote: /home/kaau/.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug2: channel_input_open_confirmation: channel 0: callback start
debug2: client_session2_setup: id 0
debug1: Sending command: hostname -f
debug2: channel 0: request exec confirm 1
debug1: pledge: fork
debug2: channel_input_open_confirmation: channel 0: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug2: client_loop: session QoS is now non-interactive
debug2: channel 0: rcvd adjust 2097152
debug2: channel_input_status_confirm: type 99 id 0
debug2: exec request accepted on channel 0
debug2: channel 0: rcvd eof
debug2: channel 0: output open -> drain
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug2: channel 0: rcvd eow
debug2: chan_shutdown_read: channel 0: (i0 o1 sock -1 wfd 4 efd 8 [write])
debug2: channel 0: input open -> closed
debug2: channel 0: rcvd close
[[yellow:tcacaueslapp003.devhcloud.bmogc.net]]                                                                          ---viola!
debug2: channel 0: obuf empty
debug2: chan_shutdown_write: channel 0: (i3 o1 sock -1 wfd 7 efd 8 [write])
debug2: channel 0: output drain -> closed
debug2: channel 0: almost dead
debug2: channel 0: gc: notify user
debug2: channel 0: gc: user detached
debug2: channel 0: send_close2
debug2: channel 0: send close for remote id 0
debug2: channel 0: is dead
debug2: channel 0: garbage collecting
debug1: channel 0: free: client-session, nchannels 1
debug2: client_loop: session QoS is now interactive
Transferred: sent 2408, received 3424 bytes, in 0.2 seconds
Bytes per second: sent 9639.9, received 13707.3
debug1: Exit status 0

Windows PowerShell ([[red:Administrator mode]])
Copyright (C) Microsoft Corporation. All rights reserved.
Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows

PS C:\Users\kaau> where.exe icacls
C:\Windows\System32\icacls.exe

PS C:\Users\kaau> echo "$env:USERPROFILE\"               
C:\Users\kaau\
PS C:\Users\kaau> echo "$env:USERPROFILE\.ssh\id_ed25519"
C:\Users\kaau\.ssh\id_ed25519

#
# remove inherited permissions:
#   - remove inherited permissions from the parent folder.
#   - keep any explicitly assigned permissions.
#   this prevents broad permissions from the user's profile folder from automatically applying to the private key
#   before:
#     id_ed25519
#      └─ inherits permissions from ${HOME}/.ssh folder
#   after:
#     id_ed25519
#      └─ only explicit ACL entries remain
#
PS C:\Users\kaau> icacls "$env:USERPROFILE\.ssh\id_ed25519" /inheritance:r  
processed file: C:\Users\kaau\.ssh\id_ed25519
Successfully processed 1 files; Failed processing 0 files

#
# remove common group permissions:
#   - /remove:g removes granted permissions for the specified groups
#   - the command removes access for:
#     - Everyone
#     - Users
#     - Authenticated Users
#     without this step, many accounts on the machine might be able to read the key
#   before:
#     Everyone Read
#     Users Read
#     Authenticated Users Read
#   after:
#     removed
#
PS C:\Users\kaau> icacls "$env:USERPROFILE\.ssh\id_ed25519" /remove:g "Everyone" "Users" "Authenticated Users"   
processed file: C:\Users\kaau\.ssh\id_ed25519
Successfully processed 1 files; Failed processing 0 files

#
# grant only the current user read access:
#   /grant:r means: replace any existing permission entry for that identity.
#   Grant (R) = Read permission.
#
#   The key owner (office\kaau) can read the private key
#
PS C:\Users\kaau> echo "$env:USERDOMAIN\$env:USERNAME"
OFFICE\kaau
PS C:\Users\kaau> icacls "$env:USERPROFILE\.ssh\id_ed25519" /grant:r "$env:USERDOMAIN\$env:USERNAME:(R)"
[[red:Invalid parameter "OFFICE\(R)"]]                                                                               ---???

PS C:\Users\kaau> icacls "$env:USERPROFILE\.ssh\id_ed25519" /grant:r "$env:USERDOMAIN\kaau:(R)"             
processed file: C:\Users\kaau\.ssh\id_ed25519
Successfully processed 1 files; Failed processing 0 files

#
# Allow SYSTEM and Administrators to read the SSH private key (optional):
#   Why?
#     - SYSTEM is used by Windows services and OS components.
#     - Administrators allows local admins to access the file when required.
#
PS C:\Users\kaau> icacls "$env:USERPROFILE\.ssh\id_ed25519"  /grant:r "SYSTEM:(R)" "Administrators:(R)"   
processed file: C:\Users\kaau\.ssh\id_ed25519
Successfully processed 1 files; Failed processing 0 files
PS C:\Users\kaau> 

#
# after all commands, the final ACL is roughly:
# 
#   office\kaau Read
#   SYSTEM      Read
#   Administrators Read
#   And no access for: Everyone
#

#
# verification:
#
PS C:\Users\kaau> icacls "$env:USERPROFILE\.ssh\id_ed25519"
C:\Users\kaau\.ssh\id_ed25519 BUILTIN\Administrators:(R)
                              NT AUTHORITY\SYSTEM:(R)
                              OFFICE\kaau:(R)
Successfully processed 1 files; Failed processing 0 files

[root@tcacaueslapp003 ~]# hostname -f
tcacaueslapp003.devhcloud.bmogc.net

[root@tcacaueslapp003 ~]# grep ^AllowTcpForwarding /etc/ssh/sshd_config
AllowTcpForwarding no

[root@tcacaueslapp003 ~]# sed -i "s/^AllowTcpForwarding.*$/AllowTcpForwarding yes/" /etc/ssh/sshd_config

[root@tcacaueslapp003 ~]# grep ^AllowTcpForwarding /etc/ssh/sshd_config
AllowTcpForwarding yes

[root@tcacaueslapp003 ~]# systemctl restart sshd.service