--- title: What is an SSH Bastion? | daily.dev description: An explanation of SSH bastion hosts (also called jump hosts) and why they reduce attack surface by centralizing SSH access to a single hardened server. Covers... canonical: https://daily.dev/posts/what-is-an-ssh-bastion--bxqmhtylo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What is an SSH Bastion? | daily.dev og:description: An explanation of SSH bastion hosts (also called jump hosts) and why they reduce attack surface by centralizing SSH access to a single hardened server. Covers... og:url: https://daily.dev/posts/what-is-an-ssh-bastion--bxqmhtylo og:image: https://api.daily.dev/og/posts/BxqmHTyLO.png og:image:alt: What is an SSH Bastion? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What is an SSH Bastion? **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary An explanation of SSH bastion hosts (also called jump hosts) and why they reduce attack surface by centralizing SSH access to a single hardened server. Covers setting one up with OpenSSH, including sshd_config hardening, ProxyJump and ProxyCommand syntax, and disabling interactive logins for bastion accounts. Also covers Teleport as an alternative that uses SSH certificates instead of keys, supports Kubernetes and HTTP(S) access, and includes a built-in web UI. Ends with guidance on choosing OpenSSH for small teams versus Teleport for growing fleets or multi-protocol needs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is an SSH bastion host and how does it differ from a jump server? An SSH bastion host and an SSH jump server refer to the same concept: a single Linux host, accessible from the internet, that is the only server allowed to accept SSH connections from outside. Users connect to the bastion first, then make a second SSH connection from the bastion to their final destination, a process called jumping. _Developers hardening infrastructure access patterns can find related security writeups on daily.dev._ ### How do I use SSH ProxyJump to connect through a bastion host without typing the flag every time? Add a Host entry to ~/.ssh/config using a wildcard, such as 'Host 10.5.5.*' followed by 'ProxyJump bastion.example.com', so any connection to a matching address automatically jumps through the bastion. This lets a user simply run 'ssh 10.5.5.10' instead of specifying 'ssh -J bastion.example.com 10.5.5.10' on every connection. _Engineers automating SSH access workflows often compare configuration tricks like this on daily.dev._ ### Should I use OpenSSH or Teleport to set up a bastion host? OpenSSH is recommended for a small number of SSH hosts and users, since key distribution and rotation overhead stays manageable and it is already installed on most machines. Teleport is a better fit for a growing server fleet or team, when a bastion needs to cover other protocols like Kubernetes or HTTPS access behind NAT, or when eliminating SSH keys in favor of certificates is a priority. _Teams weighing bastion tooling tradeoffs can track comparisons like OpenSSH versus Teleport on daily.dev._ ## Similar posts on daily.dev - [Hardening SSH: Fail2Ban, Nftables & Cloud Firewalls](https://daily.dev/posts/hardening-ssh-fail2ban-nftables-cloud-firewalls-btns6dfx7) · DigitalOcean Community · 1 upvotes · 0 comments - [Getting started with SSH: Your complete guide to understanding the secure shell](https://daily.dev/posts/getting-started-with-ssh-your-complete-guide-to-understanding-the-secure-shell-kzltkr6dq) · All Things Open · 2 upvotes · 0 comments - [The Bastion Host Was a Good Idea in 2010](https://daily.dev/posts/the-bastion-host-was-a-good-idea-in-2010-wmwkxfogz) · strongdm · 47 upvotes · 0 comments - [How to Set Up a Private Droplet and Bastion Host with Cloud Firewalls](https://daily.dev/posts/how-to-set-up-a-private-droplet-and-bastion-host-with-cloud-firewalls-hooe7lec5) · DigitalOcean Community · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/what-is-an-ssh-bastion--bxqmhtylo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What is an SSH Bastion?","url":"https://daily.dev/posts/what-is-an-ssh-bastion--bxqmhtylo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-is-an-ssh-bastion--bxqmhtylo"},"datePublished":"2026-08-23T12:22:52.800Z","dateModified":"2026-08-23T12:53:06.056Z","description":"An explanation of SSH bastion hosts (also called jump hosts) and why they reduce attack surface by centralizing SSH access to a single hardened server. Covers...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-is-an-ssh-bastion--bxqmhtylo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,ssh","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"What is an SSH Bastion?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-is-an-ssh-bastion--bxqmhtylo#faq","mainEntity":[{"@type":"Question","name":"What is an SSH bastion host and how does it differ from a jump server?","acceptedAnswer":{"@type":"Answer","text":"An SSH bastion host and an SSH jump server refer to the same concept: a single Linux host, accessible from the internet, that is the only server allowed to accept SSH connections from outside. Users connect to the bastion first, then make a second SSH connection from the bastion to their final destination, a process called jumping. Developers hardening infrastructure access patterns can find related security writeups on daily.dev."}},{"@type":"Question","name":"How do I use SSH ProxyJump to connect through a bastion host without typing the flag every time?","acceptedAnswer":{"@type":"Answer","text":"Add a Host entry to ~/.ssh/config using a wildcard, such as 'Host 10.5.5.*' followed by 'ProxyJump bastion.example.com', so any connection to a matching address automatically jumps through the bastion. This lets a user simply run 'ssh 10.5.5.10' instead of specifying 'ssh -J bastion.example.com 10.5.5.10' on every connection. Engineers automating SSH access workflows often compare configuration tricks like this on daily.dev."}},{"@type":"Question","name":"Should I use OpenSSH or Teleport to set up a bastion host?","acceptedAnswer":{"@type":"Answer","text":"OpenSSH is recommended for a small number of SSH hosts and users, since key distribution and rotation overhead stays manageable and it is already installed on most machines. Teleport is a better fit for a growing server fleet or team, when a bastion needs to cover other protocols like Kubernetes or HTTPS access behind NAT, or when eliminating SSH keys in favor of certificates is a priority. Teams weighing bastion tooling tradeoffs can track comparisons like OpenSSH versus Teleport on daily.dev."}}]} ```