Jump host vs bastion host: the difference explained

Q: Can the bastion read my SSH session?

Not with ProxyJump or ProxyCommand ssh -W. It only relays the encrypted stream, so it sees who connected, when, and to which address and port. It can read everything only if you open a shell on it and run ssh again from there.

Q: Should I use agent forwarding through a bastion?

No. Use ProxyJump. With ssh -A to the bastion, anyone with root on it can use your keys while you are connected. See agent forwarding risks.

The difference in one table

	Jump host	Bastion host
What the term describes	A role: a server you pass through	A machine built only for that role
Where it sits	Anywhere: a dev box, an admin VM, another server	At the edge, reachable from the internet or from the office
What else runs on it	Often other services	Nothing but SSH
Who can log in	Whoever has an account	Named users, often with forwarding only and no shell
Private servers	Can usually be reached other ways too	Accept SSH only from the bastion
Logging	Whatever the server keeps	Every connection logged, kept off the box

So the question is not which one to pick. A bastion is a jump host that has been made into the only door, and secured like one. Other names for the same things are jump server, jump box and SSH gateway.

How SSH passes through either one

From your side, connecting looks the same whichever it is. There are two good ways and one to avoid:

# ProxyJump, OpenSSH 7.3 and later
ssh -J user@bastion user@10.0.0.5

# ProxyCommand with -W, the older equivalent
ssh -o ProxyCommand="ssh -W %h:%p user@bastion" user@10.0.0.5

# Two separate logins: avoid
ssh -A user@bastion
ssh user@10.0.0.5

With the first two, the jump host only opens a TCP connection to the target and relays bytes. Your SSH session to 10.0.0.5 is encrypted from your machine, and your key is used from your machine. With the third, you get a shell on the jump host and start a new ssh from there, so either your private key lives on it or your agent is forwarded to it. Anyone with root on that box can then use it.

The config forms, several hops and the options that do not reach the jump host are covered in ProxyJump and jump host examples.

ProxyJump or ProxyCommand?

Use ProxyJump when the hop is an SSH server. It is shorter, it chains with commas, and each hop is a normal Host with its own user, port and key:

ssh -J bastion-eu,admin-gw db-internal

Use ProxyCommand when the way in is not plain SSH: an HTTP or SOCKS proxy through nc, or a cloud provider's command line tool that opens the session for you. ssh runs the command and talks to its standard input and output.

The two options compete: whichever is set first wins, and a command-line -o comes before the config file. To see which one applies to a host, ask ssh:

ssh -G db-internal | grep -i '^proxy'

proxyjump bastion-eu,admin-gw

What turns a jump host into a bastion

One job. A small server with SSH and nothing else: no database, no website, no build tools.
The only door. Private servers accept port 22 only from the bastion's address, at the firewall or security group.
No keys on it, no agent forwarding. Users jump through it with ProxyJump.
Forwarding only. Most users need no shell there. A Match Group block with PermitOpen limits where they may go.
Strong login. Keys only, and optionally a second factor with TOTP.
Logs kept elsewhere. Connection logs shipped off the box, so an intruder cannot erase them.
Patched often. It faces the internet, so security updates go on automatically.

The full sshd configuration, with the commands to test what is refused, is in how to set up an SSH bastion host.

Do you still need a bastion?

A bastion solves one problem: letting people reach private servers through a single, watched entry point. Other tools solve the same problem in other ways:

A VPN or a private network overlay puts your machine on the private network, so you connect to servers directly.
A cloud provider's session service opens a shell or a tunnel through the provider's API, with no open SSH port at all.
An identity-aware access proxy checks who you are on each connection and records sessions centrally.

Each moves the single door somewhere else. A bastion stays the simplest option when you want plain OpenSSH, with no agent on the servers and no extra service to run.

Questions

Is a jump server the same as a bastion host?

In everyday use, mostly yes, and jump box means the same thing. Strictly, jump server or jump host describes the role, passing you through, while bastion describes a hardened machine at the edge of a network whose only job is that role.

Can the bastion read my SSH session?

Not with ProxyJump or ProxyCommand ssh -W. It only relays the encrypted stream, so it sees who connected, when, and to which address and port. It can read everything only if you open a shell on it and run ssh again from there.

Should I use agent forwarding through a bastion?

No. Use ProxyJump. With ssh -A to the bastion, anyone with root on it can use your keys while you are connected. See agent forwarding risks.

Do I still need a bastion if I have a VPN?

Not always. A VPN or private network overlay can replace it as the way in. Many teams keep a bastion anyway as the single SSH entry point, because one machine is easy to watch, log and lock.

Sources

More in Tunnels and jump hosts

All guides