Jump Hosts and Session Brokers
A single controlled path to administrative interfaces. What a bastion provides, what it does not, and why the traditional version is being replaced.
Reference
A jump host concentrates administrative access into one path that can be controlled, monitored and recorded.
What it provides
A single point where authentication, authorisation and recording happen.
Network segmentation. Management interfaces are reachable only from the bastion, not from the general network.
A place to enforce multi-factor authentication even for protocols and systems that do not support it natively.
A recording point for sessions.
A credential boundary, where the broker holds the credential and the administrator never does.
What it does not provide
Protection if the bastion is compromised. It becomes the highest-value target in the estate.
Anything for paths that bypass it, which is why network enforcement matters more than policy.
Reduction of standing rights, which is a separate control.
Protection against a compromised administrator workstation, unless the credential never leaves the broker.
Hardening it
Minimal software. Nothing on it except what brokering requires.
No general network access outbound.
Dedicated, not shared with other functions.
Its own administrators are tier zero, and few.
Logs shipped off-box immediately, to a destination its administrators cannot alter.
Patched aggressively, because it is the target.
Access to the bastion host itself treated as a separate and higher privilege than access through it.
The traditional model and its problem
A server you log into, and from which you log into things.
The credential frequently ends up on the bastion, in a session, available to whoever compromises it.
It is a persistent host with all the exposure that implies.
Users can install things, unless prevented, and they will.
The brokered model
The system establishes the session on the administrator's behalf, injecting the credential without revealing it.
No shell on the broker itself.
Recording happens in the broker, not on the target.
The administrator's workstation never holds the credential, which closes the most common escalation path.
Prefer this where the target protocols support it, which covers most common cases.
Ephemeral alternatives
The direction of travel.
A short-lived host created per session and destroyed afterwards, so persistent compromise is not possible.
Certificate-based access with a short validity, removing the standing key distribution problem.
Identity-aware proxies that authorise per request rather than per network position.
More complex to operate and it removes the standing target that a traditional bastion represents.
Enforcing the path
A bastion nobody must use is a bastion nobody uses.
Restrict management interfaces at the network level so the bastion is the only route.
Restrict at the host level too, with logon restrictions by source.
Alert on administrative authentication from anywhere else, which is how you find the exceptions.
Expect exceptions to exist, and register them rather than assuming there are none.
Enforcing the path at the network
The control that makes an agentless deployment real.
Management interfaces reachable only from the broker, enforced at the network layer.
Rules maintained outside the administered systems, so a server administrator cannot alter them.
Host-level logon restrictions by source as a second layer.
Detection of authentication from anywhere else, compared against broker records.
Expect exceptions, and register them with reasons rather than assuming there are none. The registered exception list is the honest coverage statement.
The bastion as a target
Concentrating access creates the highest-value host in the estate.
Its administrators are tier zero, and few.
Access to the host is a higher privilege than access through it, and should be separately controlled.
Minimal software, with application control.
No outbound general network access.
Logs shipped off-box immediately, to a destination its administrators cannot alter.
Patched aggressively, on a schedule shorter than the rest of the estate.
Monitored as tier zero, with alerting to people outside the team that operates it.