Jump Server (Bastion Host)

What is a jump server?

A jump server (also jump host, jump box or bastion host) is an intermediary server through which administrators connect to systems in a protected part of the network: production servers, databases, network devices or control systems. Target systems accept administrative connections from it alone. Instead of many scattered access paths, there is one point that can be hardened, monitored and logged.

The term bastion host is generic and comes from firewall architecture, where it denotes a system exposed at the boundary between zones and therefore especially hardened. It does not refer to any particular product.

Jump server definition

A jump server is a hardened system that serves as the only permitted entry point for administrative sessions into a protected network zone. Its job is to concentrate privileged access in one place, so that it can be controlled, strongly authenticated and held accountable.

The jump server is one of the oldest patterns for controlling privileged access. Modern Privileged Access Management (PAM) systems develop it into a gateway that does not just let connections through but understands their content.

How a jump server works

Placement in the network

A jump server usually sits in a dedicated intermediate zone between the network administrators work from and the zone with protected systems. Network segmentation and firewall rules ensure that:

• the jump server can be reached only from specific addresses or through a VPN, after strong authentication,
• target systems accept administrative connections (SSH, RDP, database console) only from the jump server,
• direct administrative connections that bypass the jump server are blocked.

The session flow

The administrator authenticates on the jump server, ideally with multi-factor authentication, and then opens a connection to the target system. In the classic variant, they log into the jump server itself (for example, over RDP or SSH) and only then start the next session from it.

Plain jump host vs PAM gateway

Both approaches concentrate access in one point, but they differ in what they know about the session.

Classic jump host

This is an ordinary server with an operating system that administrators log into. It sees the login, but not what happened next. The administrator knows and types the credentials for the target systems, often from the same server others use. All administrators work on a shared machine, where files, command histories and saved passwords can linger.

PAM gateway (protocol proxy)

A PAM gateway acts as a protocol proxy: it accepts an SSH, RDP, VNC or database connection and relays it to the target system while understanding its content. As a result it can:

• record the session — see privileged session recording,
• inject credentials from a password vault, so the user never learns them,
• enforce rules: who, to which system, with which account and at what hours,
• let a supervisor watch the session and terminate it mid-way.

The user does not work on a shared machine but connects with their own client, and the gateway brokers the traffic.

Risks of an unhardened jump host

A jump server concentrates access to the most valuable systems, so it is also an attractive target. A poorly maintained jump host stops protecting and starts helping the attacker:

• Shared accounts and saved passwords — if administrators log in with one account or leave passwords in their clients, compromising the jump host gives access to everything at once.
• Missing updates — a vulnerability in the jump host’s operating system opens the way into the entire protected zone.
• Unnecessary software — a browser, email or office tools on the jump host enlarge the attack surface.
• Weak authentication — a jump host protected only by a password is exposed to credential theft.
• Bypassing — if target systems also accept direct connections, the jump host only creates an illusion of control.
• No logging — without session records it is hard to establish what happened after an incident, and an attacker who has taken over the jump host can freely carry out lateral movement.

How it works in practice — the Fudo Enterprise example

Fudo Enterprise is an example of a PAM gateway that works without agents: users connect with their own native clients or through the built-in browser-based client, and the system acts as a proxy between them and the monitored servers and registers their actions. In proxy mode, the user connects through the Fudo address and a unique port assigned to the given server; the actual addressing stays hidden, and servers can be configured to accept connections only from Fudo. In bastion mode, the target server is specified in the string that identifies the user and the server, so a group of servers is reachable through the same address and port. The vendor states that the system’s vault injects passwords and SSH keys into sessions without exposing them to users.

Benefits

• A single point of control — instead of watching dozens of access paths, the organisation watches one.
• Less exposure of systems — critical systems cannot be reached directly from user networks.
• Strong authentication in one place — MFA only has to be deployed at the entry point, not on every system.
• Accountability — with a PAM gateway, every session has an author and a record of what happened.
• Vendor control — external technicians get access through the same point, on the same terms.

Limitations and challenges

• Single point of failure — if the jump server is unavailable, administration stops, so high availability and an emergency procedure are needed.
• Maintenance — a jump server needs regular updates and reviews of accounts and firewall rules.
• A classic jump host provides no visibility — on its own it neither records sessions nor protects passwords; those capabilities come from a PAM gateway.
• Convenience versus security — an overly cumbersome login process encourages workarounds, so it is worth letting administrators use their usual clients.

Summary

A jump server (bastion host) concentrates administrative access to a protected zone in a single, hardened point. A classic jump host limits the number of access paths, and a PAM gateway adds visibility into sessions, credential protection and the ability to respond during a connection. In both cases, it is only effective if target systems accept administrative connections from nowhere else.

Related Terms

• Privileged Access Management - managing privileged access
• Privileged Access - the level of access to administrative operations
• Privileged Session Recording - capturing work on administrative accounts
• Network Segmentation - dividing a network into zones with different trust levels
• Zero Trust - a security model based on continuous verification

Explore Our Services

Want to replace a shared jump host with a gateway that records sessions and protects passwords? Explore:

• PAM Implementation - design, deployment and operation of privileged access control