How SSH Jump (ProxyJump, ssh -J) Works
① SSH #1 · TCP :22 · ③ SSH session #2: laptop ⇄ app-01, end-to-end encrypted, carried INSIDE tunnel #1 · COMMANDS & CONFIG # One-off (OpenSSH ≥ 7.3) ssh -J [email protected] [email protected] #…
On this board
- How SSH Jump (ProxyJump, ssh -J) Works
- ① SSH #1
- TCP :22
- ③ SSH session #2: laptop ⇄ app-01, end-to-end encrypted, carried INSIDE tunnel #1
- COMMANDS & CONFIG # One-off (OpenSSH ≥ 7.3) ssh -J [email protected] [email protected] # Older OpenSSH equivalent ssh -o ProxyCommand="ssh -W %h:%p alice@bastion" \ [email protected] # ~/.ssh/config Host bastion HostName bastion.example.com User alice Host app-01 HostName 10.0.1.10 User alice P…
- STEP BY STEP 1. You run: ssh -J alice@bastion [email protected] 2. Client opens TCP to bastion:22 and completes a full SSH handshake (verify bastion host key + authenticate with your key) → tunnel ①. 3. Client asks the bastion to open a "direct-tcpip" channel to 10.0.1.10:22 (same as ssh -W). The bas…
- Private network 10.0.0.0/16
- app-01
- Your machine (Internet)
- DMZ / Public subnet
- ② direct-tcpip → 10.0.1.10:22
- 10.0.1.10 (no public IP)
- SSH Client
- Firewall
- Bastion / Jump Host
- web-01
- holds your private key
- only :22 → bastion
- bastion.example.com
- 10.0.1.20
- db-01
- WHY & SECURITY NOTES • One hardened entry point; internal servers need no public IP. • Central place for MFA, audit logs and IP allow-listing. • Prefer ProxyJump over agent forwarding (ssh -A): no agent socket is exposed on the bastion. • Bastion sshd needs AllowTcpForwarding yes; restrict targets…
- 10.0.2.30
- ✗ Direct SSH impossible: private IPs not routable / blocked by firewall