Lion Cipher Lab
Set up a bastion / jump host
- Identity & Access Management
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Every machine that accepts SSH from the internet is a door someone is trying to open right now. Put SSH on ten internal boxes and you have ten doors to patch, watch, and reason about — ten places a mistake becomes a breach. A bastion (also called a jump host) collapses that into one: a single, deliberately hardened machine is the only thing reachable from outside, and every path to an internal host passes through it. That is the core access-control win. Your attack surface — the total set of points an attacker can reach and probe — shrinks from a whole fleet to one carefully guarded front…
What you'll learn
- Bastion / jump host architecture
- reducing attack surface
- SSH ProxyJump (ssh -J)
- writing a ~/.ssh/config
- hardening a bastion's SSH
- understanding agent forwarding risk
- centralized access logging
Steps in this lab
- What a bastion is, and why one front door beats many
- Designate your bastion and your internal host
- Harden the bastion's SSH — it is the one door you keep
- Reach the internal host THROUGH the bastion with ssh -J
- Make it permanent with ~/.ssh/config
- Understand agent forwarding — and why you're not using it
- Treat the bastion as the high-value target it now is
- What you built, and the instinct underneath it