What Is a Bastion Host?
A bastion host — also called a jump box — is a hardened server that serves as the single controlled entry point into a private network. Instead of exposing many internal systems to remote access, you expose one carefully guarded door: administrators connect to the bastion, then reach internal systems through it. It concentrates both exposure and defense in one place, which is exactly the point.
Why funnel access through one host?#
Because one guarded door is easier to defend than many. Without a bastion, every internal system that needs remote administration is a potential entry point exposed to attack. With one:
| Without bastion | With bastion |
|---|---|
| Many systems exposed | One system exposed |
| Harden and monitor everything | Harden and monitor one host intensively |
| Access scattered | Access logged at one chokepoint |
| Large attack surface | Minimal exposure |
Internal machines are configured to accept administrative connections only from the bastion, so compromising an internal service still does not grant a direct path in from the internet.
How do you build a good bastion?#
- Harden it intensively — minimal software, tight configuration, patched aggressively.
- Enforce strong auth — key-based SSH and MFA.
- Log everything — the bastion is your record of who accessed what.
- Restrict its reach — it should connect only to what it must.
Bastion hosts concentrate and control remote access. More at the Network Security hub.
Frequently asked questions#
What is a bastion host?
A bastion host (or jump box) is a specially hardened server that acts as the single, controlled gateway between an untrusted network and a private one. Administrators connect to the bastion first, then reach internal systems through it. Internal machines accept management connections only from the bastion, so there is one guarded door instead of many.
Why use a bastion host?
It shrinks the attack surface by removing direct internet exposure from internal systems, and it concentrates security effort: one host to harden intensively, one place to enforce MFA, and one chokepoint to log all administrative access. This makes both defense and auditing far more manageable than exposing many systems.