Jump Server: The Guide to Amplify Your Security — How to Build, Protect, and Not Turn Your Bastion Into the Back Door How a small dedicated server can be the difference between organized support and the next ransomware headline. And how, if misconfigured, it can be the exact door through which the attacker enters.
Jump Server: The Guide to Amplify Your Security — How to Build, Protect, and Not Turn Your Bastion Into the Back Door How a small dedicated server can be the difference between organized support and the next ransomware headline. And how, if misconfigured, it can be the exact door through which the attacker enters. Introduction If you read the previous post about secure remote access, you already know the golden rule: never expose RDP, SSH, or any administrative service directly to the internet . But then the practical question arises: how do the support team, DBAs, sysadmins, and vendors access servers when they need to? The traditional answer is the jump server — also called bastion host , stepping stone server , jump box . It's a concept that's been around for over 30 years and remains relevant because it solves a fundamental problem: centralizing and controlling all administrative access to an infrastructure. But here's the paradox: a misconfigured jump server is worse than having no jump server at all . Why? Because it creates a false sense of security. You think you're protected because you have "that bastion", when in reality it became exactly what you should avoid — a single point, known, exposed, and full of privileges. Part 1: What is (and what is not) a jump server A jump server is a dedicated machine, hardened to the maximum, positioned as the only point of passage between the external world and critical internal resources. Instead of each server exposing SSH or RDP, only the jump server accepts connections . Anyone who needs to administer anything must first enter the jump server, and from there reach their destinations. The analogy: if your infrastructure is a building, the jump server is the front desk with a turnstile . Nobody enters directly into the rooms — everyone passes through the front desk, shows their badge, gets registered. What is NOT a jump server: "Any" server with TeamViewer VPN (VPN puts you on the network; jump gives you access to a specific machine) Production server Substitute for identity management "Secure by existing" Why it exists: Reduces attack surface (1 point vs N) Centralizes authentication and authorization Centralizes logs and auditing Enables session recording Applies uniform policies Serves as a quarantine point Supports vendors without pain Low cost Part 2: Architectures 2.1 Simple jump server For small teams. Limitation: single point of failure and compromise. 2.2 Dual jump server (chained) For regulated environments. Attacker needs to compromise two servers. 2.3 Jump server with broker / PAM Broker validates everything, retrieves temporary credentials from the vault, establishes the session without showing the password. Solutions: CyberArk, BeyondTrust, Delinea, HashiCorp Boundary, Teleport. 2.4 Multi-tenant jump server (MSPs) Centralizes access to multiple clients. Beware: becomes the dream target. Ideally, each client should have their own segregated jump. Part 3: What needs to be inside 3.1 Minimalist operating system Jump server is not a workstation. No Office, no browser, no application, nothing non-essential. Windows: use Server Core whenever possible. 3.2 Only necessary tools Typical Linux jump has: OpenSSH, RDP client (xfreerdp), mysql/psql client, nmap, dig, traceroute, tcpdump, vim, tmux, ansible. Typical Windows jump has: mstsc, PuTTY, RSAT, PowerShell modules, SSMS. What it should NOT have: browser, email, Office, Adobe Reader, Java client, personal software, compilers. Rule: if you can't justify it, it doesn't need to be there. 3.3 Network and segmentation Inbound: Access port only (SSH, RDP, or HTTPS via ZTNA) Whitelist of source IPs Geographic blocking Outbound: Only ports necessary to allowed destinations Block unrestricted outbound to internet — critical If the attacker compromises the jump, the first thing will be to download tools and connect to C2. By blocking outbound, you break the chain. 3.4 SSH hardening Legal banner: 3.5 Windows hardening Server Core without GUI NLA enabled SMB v1 disabled Defender + Credential Guard + Device Guard AppLocker or WDAC for execution whitelist LAPS for automatic local password rotation Complete Audit Policies with forwarding to SIEM PowerShell v2 disabled PowerShell Constrained Language Mode CIS Benchmark applied via GPO Part 4: Authentication and authorization 4.1 Mandatory MFA No exceptions. For everyone. Always. Linux with Google Authenticator: The AuthenticationMethods publickey,keyboard-interactive directive forces key and TOTP. FIDO2 hardware tokens (more secure): The private key stays inside the physical token (YubiKey). Even malware on the machine cannot extract it. 4.2 Principle of least privilege Groups by function (dba-mysql, sysadmin-linux, support-tier1, vendor-acme) Granular sudo, never ALL Restricted shell when possible (rbash, lshell) Filesystem ACLs Example /etc/sudoers.d/dba-mysql: 4.3 Centralized authentication Don't use local accounts. Integrate with AD/LDAP/Azure AD/Okta/Google Worksp…