---
title: How to Set Up and Use an SSH Jumphost.
description: "An SSH jumphost (or \"bastion host\") is a secure intermediary server used to access other servers within a private network. Using a jumphost provides an additional layer of security, allowing administrators to restrict direct access to internal servers. Here’s how…"
url: "https://truehost.com/support/knowledge-base/how-to-set-up-and-use-an-ssh-jumphost/"
updated: "2024-11-02"
category: Cloud servers in Kenya
---

# How to Set Up and Use an SSH Jumphost.

An SSH jumphost (or "bastion host") is a secure intermediary server used to access other servers within a private network. Using a jumphost provides an additional layer of security, allowing administrators to restrict direct access to internal servers. Here’s how to set up and use an SSH jumphost.

### Step 1: Set Up the Jumphost Server

1. **Provision the Jumphost**:
   - Set up a server that will act as your jumphost, ideally in a secure network location with access to the internal servers you wish to reach.
   - Make sure SSH access is enabled.
2. **Harden SSH Security on the Jumphost**:

- Edit the SSH configuration file on the jumphost:

```
sudo nano /etc/ssh/sshd_config
```

- Configure options for added security:
  - Set `PermitRootLogin` to `no`.
  - Allow only specific users to access the server by adding `AllowUsers yourusername`.
  - Disable password-based logins and use SSH keys by setting `PasswordAuthentication no`.

Restart SSH to apply changes:

```
sudo systemctl restart sshd
```

3. **Set Up SSH Key-Based Authentication**:

- Generate an SSH key pair on your local machine if you don’t already have one:

```
ssh-keygen -t rsa -b 4096
```

- Copy the public key to the jumphost:

```
ssh-copy-id yourusername@jumphost_ip
```

### Step 2: Configure Internal Servers to Accept Connections from the Jumphost

1. **Allow SSH Access from the Jumphost on Each Internal Server**:
   - On each internal server you want to access via the jumphost, configure the firewall to accept SSH connections from the jumphost's IP only.
   - For example, using UFW:

```
sudo ufw allow from jumphost_ip to any port 22
```

2. **Set Up SSH Keys on Internal Servers**:

- Copy your SSH public key to each internal server. Run this from your local machine

```
ssh-copy-id -o ProxyJump=yourusername@jumphost_ip yourusername@internal_server_ip
```

- This command uses the `ProxyJump` option to access the internal server via the jumphost.

### Step 3: Access Internal Servers via the Jumphost

You can connect to the internal servers using SSH through the jumphost in two main ways:

#### Option 1: Using `ProxyJump` (Recommended)

1. Connect to an internal server by specifying the jumphost with `ProxyJump`:

```
ssh -J yourusername@jumphost_ip yourusername@internal_server_ip
```

2. Alternatively, to make this easier, add a configuration in your SSH config file on your local machine.

- Open or create the SSH config file:

```
vi ~/.ssh/config
```

- Add the following configuration:

```
Host jumphost
  HostName jumphost_ip
  User yourusername

Host internal-server
  HostName internal_server_ip
  User yourusername
  ProxyJump jumphost
```

- With this configuration, you can connect to `internal-server` with a simple command:

```
ssh internal-server
```

#### Option 2: Using `ProxyCommand`

1. If `ProxyJump` is not supported, you can use `ProxyCommand` to route traffic through the jumphost.

- Add this to your SSH config file (`~/.ssh/config`):

```
Host jumphost
  HostName jumphost_ip
  User yourusername

Host internal-server
  HostName internal_server_ip
  User yourusername
  ProxyCommand ssh -W %h:%p jumphost
```

- Now, connect to the internal server using:

```
ssh internal-server
```

### Step 4: Transfer Files through the Jumphost

You can use `scp` or `rsync` to transfer files via the jumphost.

#### Example Using `scp`:

```
scp -o ProxyJump=yourusername@jumphost_ip localfile.txt yourusername@internal_server_ip:/path/to/destination/
```

#### Example Using `rsync`:

```
rsync -e "ssh -J yourusername@jumphost_ip" localfile.txt yourusername@internal_server_ip:/path/to/destination/
```

### Additional Security Tips

- **Restrict Access to the Jumphost**: Limit access to trusted IP addresses only.
- **Enable Logging and Monitoring**: Enable logging on the jumphost to monitor access and potential unauthorized activities.
- **Use Two-Factor Authentication (2FA)**: If possible, enable two-factor authentication for SSH connections on the jumphost.
- **Regular Updates and Patching**: Keep the jumphost updated with security patches and OS updates.

## Author's Final Word

Using an SSH jumphost securely allows access to internal servers without exposing them directly to the internet, enhancing your network security.