SSH & Remote Administration

Use ProxyJump to save your sanity on multi-hop networks

🧩 The Challenge

Dealing with internal jump hosts used to be a mess of manual port forwarding or piping netcat through multiple sessions. I spent way too many nights juggling SSH agent identities just to reach a database tucked behind three different layers of firewalls.

💡 The Fix

Instead of the old-school ProxyCommand hacks, use the native ProxyJump directive in your ssh_config file. It handles the transit automatically and doesn’t leak your local keys to the intermediate jump boxes.

Host internal-server
Hostname 10.0.5.20
ProxyJump bastion-gateway

ssh internal-server

⚙️ Why It Works

This tells the local SSH client to build a clean tunnel through the bastion host before initiating the final connection. Because it handles the handshake natively, you don’t have to worry about weird shell interactions or passing keys through memory on the intermediate server.

🚀 Pro-Tip: Add -A if you absolutely must forward your agent, but keep that off unless you trust the jump box admin with your life.

Linux Tips & Tricks | © ngelinux.com | 9/10/2026