BastionHosts

A bastion host is a specially hardened computer placed on a network perimeter to withstand attacks. It acts as the primary access point from an untrusted network, such as the internet, to an otherwise protected internal network. Its main purpose is to provide administrators with controlled, auditable access to systems in private subnets while minimizing exposure of internal hosts to direct external access.

Typically, a bastion host sits in a demilitarized zone or a public subnet and is tightly restricted in terms of services and software. Access is filtered by firewalls or security groups, and authentication is strongly enforced, often with multifactor authentication. Administrators connect to the bastion via secure protocols such as SSH or RDP, and then reach internal targets through the bastion by means of port forwarding, proxying, or agent forwarding. The bastion can also host centralized management tools or jump-point services to streamline administration.

Key security considerations include limiting access to the bastion itself, enforcing least privilege, and enforcing strong authentication and regular credential rotation. Logging and monitoring should be centralized to detect unusual activity, and access should be time-bound and auditable. Reducing attack surface by disabling unnecessary services, keeping the host updated, and using ephemeral credentials or certificate-based authentication further mitigates risk. Network segmentation and failover planning are also important to maintain availability and containment.

In cloud environments, managed bastion services and jump hosts are common alternatives to self-hosted solutions. Examples include cloud-provider offerings that provide secure remote access to private resources, often with integrated auditing and MFA. The term “bastion” is sometimes used interchangeably with “jump host” or “bastion host” in practice.