Introduction

In secure infrastructure environments, production servers are often placed in private networks and are not directly accessible from the internet. Instead, administrators connect through a designated Jump Box (Bastion Host) that has controlled public access and connectivity to internal servers. This approach improves security by reducing the attack surface while maintaining administrative access. This guide explains how to configure SSH on your local machine to automatically route connections through a jump box, allowing seamless access to private servers without manually logging into the jump box first.

Prerequisites

Before proceeding, ensure the following requirements are met:

  • A Linux, macOS, or Windows system with an SSH client installed.
  • SSH access to the jump box (bastion host).
  • SSH access to the target production servers from the jump box.
  • Appropriate SSH keys configured for passwordless authentication (recommended).
  • Permission to modify the local SSH configuration file (~/.ssh/config).
  • The hostname or IP address of the jump box and target servers.

IMPLEMENTATION

Scenario/Use case:

Consider we have a jumpbox which has access to all the production machines and we don’t want to expose SSH access to the public. In such a scenario, we can allow only the jumpbox to public access, and through the jumpbox, we can access the remaining machines. But it’s a pain to log in to the jumpbox and do ssh to the production hosts.

 

Solution:

Here comes the easy solution that we can apply from your local machine so we can directly SSH from your local machine.

Assumption:

  1. You should have access to the jumpbox as well production host. Otherwise, you will have to enter the password.
  2. Hostname or IP address of Jumpbox(In our case, we are using jumpbox.domain.tld)

On your local machine, open the terminal and open .ssh/config.  This file may/may not exist. We can create the file and append the following content.

Host *
ProxyCommand  ssh username@jumpbox.domain.tld nc %h %p 2> /dev/null

 

In the above case, when the user(username) tries to log in from their local machine, it will route the traffic through jumpbox.

Advanced Use case:

Let’s consider if we have the hostname all ending with domain.tld and we can set up a jumpbox only particular to domain.tld.

Host *.domain.tld

ProxyCommand  ssh username@jb.domain.tld nc %h %p 2> /dev/null

Conclusion

Using an SSH jump box is a secure and efficient way to access private infrastructure without exposing production servers directly to the internet. By configuring SSH proxy settings in the local ~/.ssh/config file, connections can be automatically routed through the jump box, eliminating the need for manual multi-step logins. This setup enhances security, simplifies administration, and provides a scalable solution for managing large environments with restricted network access. For modern OpenSSH versions, you may also consider using the ProxyJump (-J) option, which offers a simpler and more readable alternative to ProxyCommand.

Post Views: 173

Leave a Reply