Bastion (Jump Host) — short technical guide

Provide secure, auditable access to internal servers by routing admin SSH sessions through a hardened bastion host.

Prerequisites

• SSH keypair present (private key kept secure).
• Bastion host reachable from your client.
• Bastion user account with key-based auth and, ideally, multi-factor auth.
• Internal hosts accept SSH from the bastion’s private network only.
• No passwords are embedded in configs or commands.

Quick examples (replace placeholders)

Connect using ProxyJump (recommended)

ssh -J bastion-user@BASTION_HOST INTERNAL_USER@INTERNAL_HOST

Copy file via bastion

scp -J bastion-user@BASTION_HOST local-file.txt INTERNAL_USER@INTERNAL_HOST:/remote/path/

Create a SOCKS proxy through the bastion (useful for tunneled HTTP/S traffic)

ssh -D 1080 -N -J bastion-user@BASTION_HOST bastion-user@BASTION_HOST
# Set browser to SOCKS5 localhost:1080

Repeatable SSH config (put in ~/.ssh/config; use exact placeholders)

Host bastion
  HostName BASTION_HOST
  User bastion-user
  IdentityFile ~/.ssh/BASTION_KEY
  IdentitiesOnly yes
  ForwardAgent no

Host internal-*
  User INTERNAL_USER
  ProxyJump bastion
  IdentityFile ~/.ssh/INTERNAL_KEY
  IdentitiesOnly yes

Usage after config:

ssh internal-app01.example

Agent forwarding + caution

• Avoid ForwardAgent yes unless absolutely necessary. If used, limit it to short sessions and trusted bastions only. Prefer separate keys for bastion and internal hosts.

Port forwarding to internal service

# forward local 8000 to internal host port 8080 via bastion
ssh -L 8000:INTERNAL_HOST:8080 -J bastion-user@BASTION_HOST bastion-user@BASTION_HOST -N
# then access http://localhost:8000

Windows (PuTTY / Pageant / WinSCP) — essentials

• Load private key into Pageant.
• Configure PuTTY: set Bastion as proxy (Connection → Proxy) or use PuTTY’s “ProxyJump” style via a local tunnel.
• In WinSCP, set “Tunnel” to connect through PuTTY/Plink or use SCP/SFTP via the bastion as a tunnel.

Security best practices (must-do)

• Use key-based auth only; disable password auth on bastion.
• Harden bastion: minimal services, strict patching, logging, and monitoring.
• Enforce MFA for bastion access.
• Centralise logs and audit SSH sessions.
• Restrict SSH source addresses where possible.
• Rotate keys and remove stale accounts regularly.
• Use jump-host-specific keys (do not reuse personal keys across long-lived systems).

Troubleshooting (concise)

• Permission denied → check key path, ssh -v for debugging, file modes (private key should be 600).
• Connection timed out → firewall or wrong host/port. Verify bastion reachability.
• ProxyJump not supported → use ProxyCommand fallback:

ssh -o ProxyCommand="ssh -W %h:%p bastion-user@BASTION_HOST" INTERNAL_USER@INTERNAL_HOST

Logging & auditing

• Enable server-side session logging (auditd, syslog, or SSH session recording).
• Keep bastion ephemeral access controlled by short-lived accounts or jump-box access tokens.

One-line checklist before connecting

1. Confirm local key and file permissions.
2. Confirm bastion host and user.
3. Confirm internal host name and user.
4. Prefer ssh -J or ~/.ssh/config for repeatability.
5. Avoid agent forwarding unless necessary.

If you want, I can produce a ready-to-drop ~/.ssh/config template with your chosen placeholder names or a short checklist for your ops team.