What is a Bastion Host and why do you need one?

If you put your database server directly on the public internet, you are asking for trouble. Anyone with an IP scanner can find it, probe it, and eventually break into it.

The standard way to fix this is to put your sensitive servers inside a private network. But if they are private, how do you SSH into them to run updates or check logs? You use a bastion host.

How a bastion host works

A bastion host (often called a jump server) is just a regular Linux machine that sits on the edge of your network. It has a public IP address. Your internal servers, like your database or application backend, do not.

When you need to manage an internal server, you SSH into the bastion host first. From there, you SSH into the internal machine. The bastion acts as a secure choke point.

Securing the choke point

Because the bastion is the only way in, it becomes a massive target. You must lock it down completely.

1. Turn off password authentication and require SSH keys.
2. If possible, whitelist the IP addresses that are allowed to connect to it.
3. Monitor the logs for failed login attempts.

For a full breakdown of how to harden this machine, read our guide on locking down your SSH server.

The annoyance of jumping

The problem with jump servers is the workflow. Logging into Server A just so you can log into Server B gets tedious fast.

You can configure your local SSH config file to handle the jump automatically using the ProxyJump directive. This tells your SSH client to tunnel through the bastion in the background.

Host my-bastion
  HostName 198.51.100.1
  User admin

Host internal-db
  HostName 10.0.0.5
  User ubuntu
  ProxyJump my-bastion

Now, typing ssh internal-db automatically routes through the bastion.

Managing jump hosts from a browser

If you are away from your main computer, dealing with jump hosts and moving SSH keys around is a nightmare. This is exactly why we built SSHDock.

SSHDock has native support for jump hosts built directly into the connection UI. You enter your bastion details, enter your internal server details, and the web SSH client handles the tunneling automatically. You don't have to edit config files or copy your private keys to the jump server itself.