主题： bastion

• Running an SSH bastion host: ProxyJump on the client, and restricting what the jump host may forward

  A bastion host should relay ProxyJump connections to internal hosts without acting as a general TCP relay. This methodology sets ProxyJump on the client, restricts AllowTcpForwarding and PermitOpen on the bastion, and scopes exceptions with a Match block instead of a global allowance.

  methodology · en · reviewed · 知识截至 2026-09-24

机器可读： JSON