Administrators require privileged access to critical infrastructure. Exposing SSH or RDP ports directly to the internet or corporate network is a massive risk. Jump boxes (Bastion hosts) act as heavily fortified, audited gateways for all administrative sessions.
A bastion host sits in a dedicated management zone. It is the only system allowed to initiate administrative connections to production servers. All admin traffic is funneled through this single choke point, enabling strict MFA and session recording.
💡 Pro-tip: Disable all direct SSH/RDP access on production servers. Configure their host firewalls to ONLY accept management connections from the specific IP address of the Bastion host.
The -J flag routes the SSH connection through the bastion host securely, ensuring the admin never directly exposes their client to the internal production network.
Modern bastion solutions (like CyberArk or Apache Guacamole) record the entire terminal session or GUI screen. This provides an immutable audit trail of exactly what commands an administrator executed during an incident.
⚠️ The bastion host is the crown jewel. If an attacker compromises the bastion, they own the entire infrastructure. Harden it relentlessly: disable root login, enforce hardware MFA, and restrict outbound internet access.
| Feature | Standard SSH | Bastion Host |
|---|---|---|
| Access Control | IP based | Identity + MFA |
| Audit Trail | Syslog only | Full Session Recording |
| Attack Surface | Every server | Single hardened host |
Verify exercises to earn ★ 220 XP and unlock next lab level.