What a jump host does
A jump host, also called a bastion, is a server you can reach directly and that can reach your internal servers. Only the bastion's SSH port is exposed; the internal servers accept SSH only from the internal network. With ProxyJump your client opens one SSH connection to the bastion and a second, end-to-end encrypted connection through it to the target. The bastion passes the traffic on but does not see the session contents, and your private key stays on your computer.
Connect from the command line
The -J option names the jump host. Separate several hops with commas; they are used in the order you give them. Add the settings to ~/.ssh/config when you use the same route regularly, so a short alias is enough.
ssh -J admin@bastion.example admin@app.internal
ssh -J admin@bastion.example,ops@hop2.example admin@app.internal
# ~/.ssh/config
Host app-internal
HostName app.internal
User admin
ProxyJump admin@bastion.exampleVerify every host key
Each hop is a separate SSH server with its own host key, so confirm the fingerprint of the bastion and of the target through another trusted channel. A changed key on any hop deserves the same attention as on a direct connection. Compare the fingerprint offered during the first connection with the value an administrator reads on the server.
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub -E sha256Prefer ProxyJump to agent forwarding
Agent forwarding (ssh -A) lets anyone with sufficient rights on the bastion use your loaded keys while you are connected. ProxyJump does not need it, because authentication to the target happens from your own computer. Also avoid storing private keys on the bastion and limit who may log in there.
Common failures
First work out which hop fails: connect to the bastion alone, then run ssh -vvv with -J to see where the connection stops. If the bastion works but the target does not, the cause is usually a firewall between them, a wrong internal name or a target that does not accept your key. A server configured with AllowTcpForwarding no refuses to act as a jump host.
Jump hosts in CH-J Server Manager
Alpha 0.1.1 connects through a saved or manually entered jump host, and saved hosts can form a chain of up to three jump hosts. The host key is checked on every hop. The availability monitor checks a server behind a jump host only through an open session to that jump host; otherwise it shows the server as not verified, never as online. Beta 0.1.0 does not have this feature.