{
  "id": 4875385,
  "title": "ProxyJump: reach servers behind a bastion without copying keys around",
  "url": "https://urgent.news/2026/09/01/proxyjump-reach-servers-behind-a-bastion-without-copying-keys-around",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T14:17:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/wolfhound1995/proxyjump-reach-servers-behind-a-bastion-without-copying-keys-around-2h3i"
  },
  "original_language": "en",
  "account": "In production networks, a single gateway, known as a bastion or jump host, is placed in front of all other machines. This bastion allows external SSH connections while keeping the internal servers hidden behind it. The challenge is to reach these internal servers without compromising security. The solution is ProxyJump.\n\nProxyJump is a method that enables SSH connections to a bastion host and then establishes a second SSH connection directly to the target server. This process securely transports data without exposing the private key to the bastion. The bastion only carries encrypted data and does not see the private key or agent, ensuring its security.\n\nProxyJump can be used for multiple hops, allowing the connection to traverse several gateways. This is achieved by specifying the order of the gateway hosts comma-separated. Once configured in the ssh_config file, ProxyJump becomes a seamless way to reach internal hosts without the need for manual input.\n\nUnlike previous methods, ProxyJump does not copy private keys to the bastion, nor does it forward the SSH agent. These approaches expose the private key or SSH agent to the bastion, which contradicts the purpose of having the bastion in place.\n\nProxyJump is a safer and cleaner way to reach servers behind a bastion, keeping the private key on your local machine and avoiding the exposure of the SSH agent. It is the recommended method for traversing bastions and accessing internal servers.",
  "summary": "Most production networks put a single gateway in front of everything. A bastion, a jump host, a jump box — one machine that accepts SSH from the outside world, with the servers you actually care about sitting on a private network behind it, no public address of their own. The question is how to get through that gateway to the box behind it without making a mess of your keys . The clean answer is…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}