ProxyJump and jump hosts - secure access patterns

ProxyJump (introduced in OpenSSH 7.3) is the modern, secure way to use an intermediate SSH host as a bastion. It replaces the older ssh -tt chains and provides a cleaner, more controllable pattern.

How ProxyJump works

ProxyJump makes an intermediate SSH connection and then opens a direct-tcpip channel from the operator’s local host through the intermediate to the final target. The intermediate does not see the final session; it is a TCP forward.

operator --ssh(1)--> bastion --tcp forward--> production
                |
                +-- ssh(2) channel inside ssh(1)

The operator has one SSH session (to the bastion), but the final connection to production goes through that session.

Basic usage

ssh -J bastion.example.com user@production-1

-J is the ProxyJump option. The bastion is logged into first; the production login happens through the bastion’s connection.

Multiple hops

ssh -J bastion1,bastion2 user@production

Comma-separated hops. Each bastion logs in sequentially, and the production login happens at the end.

~/.ssh/config

Host bastion
    HostName bastion.example.com
    User jumpuser
    IdentityFile ~/.ssh/bastion_key

Host prod-*
    User admin
    IdentityFile ~/.ssh/prod_key
    ProxyJump bastion

Now:

ssh prod-1       # automatically goes through bastion
ssh prod-2       # same
scp file prod-3:/tmp/   # SCP also works

Combine with port forwarding

ProxyJump works alongside local and remote port forwarding:

ssh -J bastion -L 8080:internal-db:5432 user@production

This opens a local listener on port 8080 that, through the bastion and the production host, reaches an internal database. Useful for accessing services that are not directly reachable.

Multiple ssh sessions

Each ssh command opens its own connection through the bastion. If you need multiple sessions to the same host (SSH multiplexing):

Host prod-*
    ControlMaster auto
    ControlPath ~/.ssh/sockets/%r@%h-%p
    ControlPersist 10m

After the first connection, additional sessions reuse the existing connection. Faster, less load on the bastion.

ProxyJump vs agent forwarding

ProxyJump is strictly better than agent forwarding for the “reach a host through a bastion” pattern:

Use ProxyJump for bastion access. Reserve agent forwarding for cases where the bastion must use your keys (e.g. a specific key is required on the production host).

ProxyCommand (older alternative)

Before ProxyJump, the pattern was:

Host prod-1
    ProxyCommand ssh bastion -W %h:%p

ProxyCommand runs an arbitrary command to establish the connection. -W %h:%p runs an SSH-level forward.

ProxyJump is essentially ProxyCommand ssh -W %h:%p. Use ProxyJump for new configs; ProxyCommand only when you need the flexibility.

Combined with SSH tunnels

ssh -J bastion -L 2222:target-internal:22 user@production

This sets up a tunnel that lets you:

ssh -p 2222 localhost

reach an internal host from your local machine.

Knowledge check