ProxyJump

Hopping through a bastion

ProxyJump lets you reach a target host by first connecting through an intermediate host (a "jump host" or "bastion"). Common pattern when internal servers aren't directly reachable from the internet — you SSH to the bastion, then from there to the internal host. ProxyJump automates the two-step.

Command line vs config

You can use it ad-hoc with -J, or bake it into ~/.ssh/config with the ProxyJump directive.

Why it's better than agent forwarding

Two ways to hop through a bastion:

Agent forwarding (-A) — your local agent socket is exposed on the bastion. Anyone with root there can use it to authenticate as you elsewhere.
ProxyJump (-J / ProxyJump) — your local SSH client opens a TCP tunnel through the bastion to the target, then runs a fresh SSH negotiation with the target. The bastion just shuffles encrypted bytes; your key never enters the bastion in any usable form.

Default to ProxyJump. Use agent forwarding only when ProxyJump genuinely doesn't fit and you trust the bastion completely.

Code

Command-line and config·ssh-config

# ~/.ssh/config

# The bastion (publicly reachable)
Host bastion
    HostName bastion.example.com
    User you_username
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

# Internal target — only reachable through bastion
Host internal-server
    HostName 10.0.0.50
    User you_username
    ProxyJump bastion

# Multi-hop — through two bastions
Host deep-target
    HostName 10.10.10.10
    User you_username
    ProxyJump hop1,hop2

scp and rsync just work·bash

# Now this two-hop is invisible:
ssh internal-server

# scp through the jump
scp file.txt internal-server:/tmp/

# rsync through the jump
rsync -avz ./project/ internal-server:/home/you_username/project/

# One-shot CLI ProxyJump
ssh -J bastion 10.0.0.50
ssh -J hop1,hop2 deep-target

Exercise

If you have a bastion-style setup (cloud VPC, work network), add a ProxyJump-using block to your config. If not, simulate it on your LAN: have ssh internal actually go through ssh office first via ProxyJump office. Test that ssh internal works exactly the same as before. The point is the local muscle memory — hops should be invisible.