I suggest abandoning scp for this purpose; instead, you should pipe tar through two ssh instances.
The following code snippet assumes that (a) ssh-agent is already running in your login environment (you can verify that with echo $SSH_AGENT_PID), (b) you have set up public key authentication for both portal and destination (i.e., populated ~/.ssh/authorized_keys properly on both portal and destination, and you have the matching private keys on Desktop).
# Load the identities (private keys) into ssh-agent on Desktop:
ssh-add ~/.ssh/id_rsa_for_portal
ssh-add ~/.ssh/id_rsa_for_destination
# Create a tape archive on Desktop, pipe it over portal, extract it
# on destination.
tar -c file1 file2 ... \
| ssh -A portal ssh destination tar -x -v
The ssh command that you run on Desktop will:
- log in to
portal without asking for a password,
- not allocate a pseudo-terminal on
portal,
- forward the ssh agent connection to
portal,
- launch the command
ssh destination tar -x -v on portal.
The ssh command run thusly on portal will:
- log in to
destination without asking for a password (thanks to the forwarded agent connection),
- not allocate a pseudo-terminal on
destination,
- launch the command
tar -x -v (extract verbosely) on destination.
The stdout of the local tar command (on Desktop) will be forwarded over both ssh connections to the stdin of the remote tar on destination. The remote tar process will extract the files, list their names on stdout (which is going to be forwarded back to your local ssh command's stdout, on Desktop), and report any errors on stderr (which is going to be forwarded back to your local ssh command's stderr). The exit status of the remote tar process will be reflected as the exit status of the local ssh command, on Desktop.
sshto the destination usingProxyJumpon the portal?ssh -J login_to@portal login_to@destination?:afterdestination-login.