Jump Hosts / Bastion

One hardened gateway, many internal machines

A bastion host (jump host) is a single, heavily hardened machine that's the only one exposed to the internet. All other machines have private IPs; you reach them only by first SSH'ing to the bastion and then onward. The attack surface drops from N to 1 — instead of hardening every machine to public-internet standards, you harden the bastion.

How it pairs with ProxyJump

Track 3 covered ProxyJump — the SSH client side of the bastion pattern. The full picture: bastion has a public IP, the rest don't. Bastion runs sshd configured for keys-only, fail2ban, port-changed, key-only access (per-key restricted to ProxyJump). Internal machines accept SSH only from the bastion's IP.

Code

Architecture in ASCII·plaintext

Internet ─→ [bastion (only public IP)] ─→ Internal machines (private IPs)
                       │
                       ├─ keys only, no passwords
                       ├─ non-default port
                       ├─ fail2ban aggressive
                       ├─ minimal software
                       └─ logged + monitored

Client-side ~/.ssh/config·ssh-config

# The bastion
Host bastion
    HostName bastion.example.com
    Port 2222
    User you_username
    IdentityFile ~/.ssh/id_ed25519

# Internal machines, only reachable through bastion
Host office server music
    User you_username
    ProxyJump bastion

Host office
    HostName 10.0.0.10
Host server
    HostName 10.0.0.11
Host music
    HostName 10.0.0.12

Bastion hardening checklist·bash

# All on the bastion:
#   PasswordAuthentication no
#   KbdInteractiveAuthentication no
#   PubkeyAuthentication yes
#   PermitRootLogin no
#   AllowUsers you_username        # only specific accounts
#   MaxAuthTries 3
#   ClientAliveInterval 300
#   Port 2222 (or whatever)
#   X11Forwarding no
#   PermitEmptyPasswords no

# fail2ban with aggressive thresholds
# Firewall: ufw allow 2222/tcp from <known sources only>
# Audit logging: ship to a central log host or off-box S3
# Minimal packages: nothing on the bastion that doesn't need to be there

Exercise

Decide for your environment: do you need a bastion, or does Tailscale solve the same problem? For most personal fleets, Tailscale wins — no exposed ports, identity-based access, encrypted by default. For a compliance-driven environment that can't use Tailscale, document the bastion's hardening using the checklist above. Pick deliberately, not by default.

One hardened gateway, many internal machines

How it pairs with ProxyJump

Code

External links

Exercise

Progress

Comments 0