Bastion Hosts: The Jump Box

Securely Entering the Back Office

You need to SSH into an application server in your private subnet to investigate a production issue. The server has no public IP — by design. How do you get in?

You use a Bastion Host (also called a Jump Box): a small, hardened server placed in a Public Subnet whose sole purpose is to serve as a secure entry point for administrative access to private resources.

The access flow:
1. From your laptop, you SSH to the Bastion Host's public IP.
2. From the Bastion Host, you SSH to the private IP of your target server.
3. You do your work, then disconnect both sessions.

The private server's security group only needs to allow SSH from the Bastion Host's private IP — not from the entire internet.

Security Hardening is Non-Negotiable

Because the Bastion Host is internet-facing, it is a high-value target. Treat it accordingly:

• Restrict source IPs: The security group should only allow SSH (port 22) from your organization's known IP ranges. Never open it to 0.0.0.0/0.
• Disable password authentication: Use SSH key pairs only. Set PasswordAuthentication no in /etc/ssh/sshd_config.
• Use SSH agent forwarding: Rather than storing private keys on the bastion (a security risk), use SSH agent forwarding so your local key is used for the second hop without ever leaving your machine.
• Minimal footprint: Install nothing on the bastion beyond what's needed for SSH access. No web servers, no databases, no application code.
• Enable audit logging: Log all SSH sessions (who connected, when, what commands were run) to a centralized, tamper-resistant log store.
• Patch aggressively: The bastion OS must be kept up to date. Consider using an immutable bastion — replace it with a fresh image weekly rather than patching in place.

Modern Alternative: Session Manager

Cloud providers now offer alternatives that eliminate the need for a bastion host entirely. AWS Systems Manager Session Manager, for example, lets you open a shell session to a private EC2 instance through the AWS API — no public IP, no open SSH port, no bastion required. Access is controlled via IAM policies and all sessions are logged automatically. For new architectures, evaluate this approach before defaulting to a bastion.