↓ Skip to main content
Le Site de François
  1. Index/

Bastion Host (Jump Server)

Security Networking Infrastructure Ssh Access-Control

A bastion host (also called a jump server or jump host) is a hardened server placed at the boundary between a public network and a protected private network, through which all administrative access to internal systems must pass. Rather than exposing every server, database, or network device directly to the internet or to operator workstations, the network is designed so that only the bastion host has a publicly reachable address; internal systems accept SSH or RDP connections only from the bastion’s IP. An administrator who needs to reach an internal host connects first to the bastion — authenticating with a key, certificate, or MFA — and then hops onward to the target from there. The bastion’s narrow exposure makes it a concentrated target, which is why it receives disproportionate hardening: a minimal OS with only the necessary services running, strict firewall rules, aggressive patch cadence, and comprehensive session logging. The name comes from military fortification: a bastion is a protruding element of a castle wall designed to be defended at all costs.

The bastion model enforces two security properties that are otherwise difficult to achieve at scale. First, auditability: because every administrative connection flows through a single point, every session can be logged, recorded, and attributed to an individual — there is no path by which an operator can reach a production system without the bastion capturing the traffic. Second, attack surface reduction: internal hosts have no externally routable addresses and no open administrative ports facing the internet, so the only attack vector into the administrative plane is the bastion itself. Network segmentation rules enforce this geometrically: a misconfigured internal host that accidentally opens a port is still not reachable from the internet because the security group or firewall only permits ingress from the bastion’s address. The trade-off is that the bastion becomes a critical single point of failure for access and a high-value target — a compromised bastion is a compromised administrative plane.

Modern infrastructure has evolved the bastion concept in two directions. PAM platforms (CyberArk, BeyondTrust, Teleport, and others) replace or augment the raw SSH jump host with a structured access management layer: session recording, credential injection (the operator never sees the target password), RBAC-based authorization, and time-bound access grants. Zero Trust Network Access (ZTNA) solutions replace the network-layer bastion model entirely: instead of a single hardened perimeter hop, each connection is individually authenticated, authorised, and encrypted between the operator’s device and the specific target resource, with no implicit trust granted to anything on the same network segment. Both directions preserve the bastion’s core intent — no unmediated administrative access to production systems — while eliminating the single point of failure and the permanent standing access that a traditional bastion implies. In cloud environments, managed bastion services (AWS Systems Manager Session Manager, Azure Bastion) remove the need to operate a bastion host at all by proxying SSH and RDP sessions through the cloud control plane without requiring any open inbound ports.

Related

PAM (Privileged Access Management)

Security Identity Access-Control Compliance Infrastructure
Privileged Access Management (PAM) is the security discipline concerned with controlling, auditing, and minimising the use of privileged accounts: root access, domain administrator rights, cloud IAM roles with wide permissions, database superuser credentials, service account tokens, and any other identity that can cause systemic damage if misused. The threat PAM addresses is specific: an attacker who obtains a regular user credential can typically access that user’s data; an attacker who obtains a privileged credential can move laterally, disable security controls, exfiltrate everything, and deploy ransomware. PAM is therefore not a generalisation of identity and access management (IAM) but a specialisation of it — the same concepts of authentication and authorisation, applied with far higher friction to the accounts that most need it.

Break-Glass User (Emergency Access Account)

Security Access-Control Incident-Response Pam Compliance
A break-glass user (or break-glass account, emergency access account) is a privileged account that exists outside the normal access control workflow — bypassing PAM approval gates, MFA requirements, or SSO dependencies — and is reserved for situations where those normal mechanisms are themselves unavailable or would prevent responding to a critical incident in time. The name is a physical analogy: like the fire alarm panel behind a pane of glass that reads break glass in emergency, the account is designed so that accessing it requires a deliberate, detectable act. It is not a convenience mechanism; it is an organisational safety net for scenarios such as an identity provider outage locking all administrators out of their own infrastructure, a PAM platform failing during an active incident, or a ransomware attack disabling the tooling needed to contain it.

IPsec (Internet Protocol Security)

Security Networking Cryptography Vpn Encryption Layer3
IPsec (Internet Protocol Security) is a suite of IETF standards (core specification RFC 4301) that adds cryptographic security to IP packets at the network layer, transparently to applications running above it. Where TLS secures a specific connection between two application endpoints, IPsec secures all IP traffic between two hosts or networks — including traffic from applications that have no TLS support, protocols that predate encryption (routing protocols, SNMP, ICMP), and layer-3 metadata that TLS cannot protect. IPsec provides two protocol headers: AH (Authentication Header, IP protocol 51) signs the IP packet including immutable header fields, providing integrity and source authentication without confidentiality — rarely used in modern deployments because NAT rewrites fields that AH covers. ESP (Encapsulating Security Payload, IP protocol 50) encrypts the payload and provides authenticated encryption with AES-GCM or ChaCha20-Poly1305, optionally protecting the inner IP header as well; ESP is the universally deployed choice. Both operate in two modes: transport mode protects only the payload of an existing IP packet (used for host-to-host encryption between endpoints that share routing), and tunnel mode encapsulates the entire original IP packet inside a new one with new source and destination addresses — the basis of VPN gateways where traffic from one network is tunnelled to another through the public internet.