When managing enterprise Linux networks, security best practices dictate that internal servers (like database nodes) should never be directly accessible from the public internet. Instead, administrators connect to a highly secured, internet-facing server known as a “jump host” or “bastion host,” and then initiate a second connection to the internal server. While secure, manually hopping between servers is tedious. The solution is the SSH ProxyJump directive, which automates this process seamlessly.
How ProxyJump Automates Network Routing
Historically, administrators used complex port forwarding rules or the older ProxyCommand to achieve seamless routing through a jump host. OpenSSH introduced the much simpler -J flag (ProxyJump) in version 7.3. When you use ProxyJump, your local machine securely tunnels your connection through the jump host and directly to the internal server in a single command, without ever exposing the internal server to the public internet.
What You Need Before Starting
To use this feature, you need:
- A local Linux or macOS machine with OpenSSH version 7.3 or newer.
- A public-facing Linux jump host that you can access via SSH.
- An internal Linux server that is only accessible from the jump host.
- SSH key authentication configured for both servers to prevent double password prompts.
Using ProxyJump from the Command Line
The fastest way to use this feature is directly from the terminal using the -J flag. The syntax requires you to specify the jump host first, followed by the final destination.
Assume your jump host is jump.example.com and your internal server is 10.0.0.5.
ssh -J [email protected] [email protected]
When you execute this command, SSH connects to the jump host, creates a secure tunnel, and instantly logs you into the internal server. Your terminal prompt will reflect the internal server, completely obscuring the intermediate step.
Configuring ProxyJump in Your SSH Config File
While the command line flag is useful, typing it repeatedly is inefficient. For a permanent solution, you should define the routing logic in your local SSH configuration file. This allows you to connect to the internal server using a simple, memorable name.
- Open your local SSH configuration file using a text editor like nano:
nano ~/.ssh/config
- First, define your public jump host. Add the following block to the file:
Host bastion
HostName jump.example.com
User your_username
IdentityFile ~/.ssh/id_rsa- Next, define the internal server and instruct it to use the jump host. Add this block directly below:
Host database-server
HostName 10.0.0.5
User your_username
ProxyJump bastion- Save the file by pressing Ctrl + O, press Enter, and then exit nano by pressing Ctrl + X.
Connecting Using the Configuration File
Now that your ~/.ssh/config file is configured, the connection process is incredibly simple. You no longer need to remember IP addresses or routing paths.
To connect to the internal server, simply run:
ssh database-server
Your local SSH client will automatically parse the configuration, authenticate with the jump host, create the secure tunnel, and log you into the internal database server instantly.
Security Recommendations
A jump host is a critical security chokepoint. Ensure your jump host is hardened by disabling password authentication completely, enforcing key-based access, and running fail2ban. Because ProxyJump passes your local SSH keys directly to the final destination, your private keys remain safely on your local machine and are never exposed to the jump host itself.