A jump host (also known as a jump server) is an intermediary host or an SSH gateway to a remote network, through which a connection can be made to another host in a dissimilar security zone, for example a demilitarized zone (DMZ). It bridges two dissimilar security zones and offers controlled access between them.
A jump host should be highly secured and monitored especially when it spans a private network and a DMZ with servers providing services to users on the internet.
A classic scenario is connecting from your desktop or laptop from inside your company’s internal network, which is highly secured with firewalls to a DMZ. In order to easily manage a server in a DMZ, you may access it via a jump host.
In this article, we will demonstrate how to access a remote Linux server via a jump host and also we will configure necessary settings in your per-user SSH client configurations.
Consider the following scenario.
In above scenario, you want to connect to HOST 2, but you have to go through HOST 1, because of firewalling, routing and access privileges. There is a number of valid reasons why jumphosts are needed..
Dynamic Jumphost List
The simplest way to connect to a target server via a jump host is using the
-J flag from the command line. This tells ssh to make a connection to the jump host and then establish a TCP forwarding to the target server, from there (make sure you’ve Passwordless SSH Login between machines).
$ ssh -J host1 host2
If usernames or ports on machines differ, specify them on the terminal as shown.
$ ssh -J [email protected]:port [email protected]:port
Multiple Jumphosts List
The same syntax can be used to make jumps over multiple servers.
$ ssh -J [email protected]:port,[email protected]:port [email protected]:port
Static Jumphost List
Static jumphost list means, that you know the jumphost or jumphosts that you need to connect a machine. Therefore you need to add the following static jumphost ‘routing’ in
~/.ssh/config file and specify the host aliases as shown.
### First jumphost. Directly reachable Host vps1 HostName vps1.example.org ### Host to jump to via jumphost1.example.org Host contabo HostName contabo.example.org ProxyJump contabo
Now try to connect to a target server via a jump host as shown.
$ ssh -J vps1 contabo
The second method is to use the ProxyCommand option to add the jumphost configuration in your
$HOME/.ssh/config file as shown.
In this example, the target host is contabo and the jumphost is vps1.
Host vps1 HostName vps1.example.org IdentifyFile ~/.ssh/vps1.pem User ec2-user Host contabo HostName contabo.example.org IdentifyFile ~/.ssh/contabovps Port 22 User admin Proxy Command ssh -q -W %h:%p vps1
Where the command
ProxyCommand ssh -q -W %h:%p vps1, means run ssh in quiet mode (using
-q) and in stdio forwarding (using
-W) mode, redirect the connection through an intermediate host (vps1).
Then try to access your target host as shown.
$ ssh contabo
The above command will first open an ssh connection to vps1 in the background effected by the ProxyCommand, and there after, start the ssh session to the target server contabo.
For more information, see the ssh man page or refer to: OpenSSH/Cookbxook/Proxies and Jump Hosts.
That’s all for now! In this article, we have demonstrated how to access a remote server via a jump host. Use the feedback form below to ask any questions or share your thoughts with us.