ProxyJump: reach servers behind a bastion without copying keys around
Most production networks put a single gateway in front of everything. A bastion, a jump host, a jump box — one machine that accepts SSH from the outside world, with the servers you actually care about sitting on a private network behind it, no public address of their own. The question is how to get through that gateway to the box behind it without making a mess of your keys . The clean answer is…
In production networks, a single gateway, known as a bastion or jump host, is placed in front of all other machines. This bastion allows external SSH connections while keeping the internal servers hidden behind it. The challenge is to reach these internal servers without compromising security. The solution is ProxyJump.
ProxyJump is a method that enables SSH connections to a bastion host and then establishes a second SSH connection directly to the target server. This process securely transports data without exposing the private key to the bastion. The bastion only carries encrypted data and does not see the private key or agent, ensuring its security.
ProxyJump can be used for multiple hops, allowing the connection to traverse several gateways. This is achieved by specifying the order of the gateway hosts comma-separated. Once configured in the ssh_config file, ProxyJump becomes a seamless way to reach internal hosts without the need for manual input.
Unlike previous methods, ProxyJump does not copy private keys to the bastion, nor does it forward the SSH agent. These approaches expose the private key or SSH agent to the bastion, which contradicts the purpose of having the bastion in place.
ProxyJump is a safer and cleaner way to reach servers behind a bastion, keeping the private key on your local machine and avoiding the exposure of the SSH agent. It is the recommended method for traversing bastions and accessing internal servers.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
