What is a jump server?
A jump server is a hardened system that administrators sign in to first, and then use to connect onward to the servers, network devices and consoles they manage. It is also called a jump box, jump host or bastion host. Instead of every administrator's laptop being able to open SSH or RDP sessions to every server, only the jump server may reach those administrative ports. That turns many scattered paths into one controlled, logged entry point.
The jump server usually lives in a management zone or a small dedicated subnet. Firewall rules let administrators reach the jump server, and let the jump server, and nothing else, reach SSH on TCP 22, RDP on TCP 3389 and HTTPS admin pages on the systems behind it.
How a jump server is hardened
- Strong sign-in: multifactor authentication, ideally phishing-resistant, tied to named accounts in the central directory. No shared logins.
- Minimal software: no email, no web browsing, no office applications and no unneeded services, so there is little for an attacker to exploit.
- Logging and recording: every connection is logged, and many organizations record sessions or keystrokes so an investigator can see exactly what was done.
- Restricted reach: each group of administrators can reach only the systems it manages.
- Fast patching and close monitoring: it holds the path to everything behind it, so it is patched promptly and watched for unusual sign-ins.
Privileged access management tools often sit on or in front of the jump server. They check out a vaulted credential for the session, so the administrator never sees the target's password, and rotate it afterward.
Example: hopping through a jump host
With OpenSSH, an administrator can reach an internal server through the jump host in one command:
ssh -J alee@jump01.corp.example.com alee@10.30.4.12
The client first connects to jump01, asks it to forward a connection to 10.30.4.12, and then runs the SSH session to the internal server through that forwarded connection. The internal server accepts SSH only from the jump host's address, so a phished workstation on the user network cannot reach it directly. Because the inner session stays encrypted end to end, the jump host in this pattern sees the connection but not the commands. Organizations that need full session recording have administrators sign in to the jump server itself, or use a PAM proxy that terminates and records the session.
On Windows networks, a Remote Desktop Gateway plays a similar role for RDP, wrapping sessions in HTTPS on TCP 443 and checking policy before forwarding. Cloud providers offer managed bastion services that open browser-based sessions to instances that have no public IP address at all.
Jump server vs. VPN, PAW and proxy
- VPN: puts a remote device on the network, often with broad reach. A jump server is a single administrative entry point inside the network; many designs require the VPN first and the jump server second.
- Privileged access workstation (PAW): the hardened device an administrator works from. The jump server is the intermediate host they connect through. The two are often used together.
- Proxy server: forwards users' web requests or publishes web servers; it is not an administrative entry point.
- Older meaning of bastion host: some texts use bastion host for any hardened system exposed to the internet, such as a server in the screened subnet. Read the scenario to see which sense is meant.
Where to place it
Put the jump server in the management zone. In the screened subnet, it would start the administrative path in the zone most likely to be compromised; on the user network, it would sit beside the most phished machines. In the cloud, a bastion host often sits in a small public subnet as the only way into private instances; its role is unchanged. Because it concentrates access, it is a high-value target in its own right: an attacker who controls it can reach everything behind it. If it can reach domain controllers, protect it like a domain controller.
Jump server on the CompTIA Security+ exam
SY0-801 no longer names jump servers as a separate item, but they remain the standard answer for secure remote administration, which objective 3.2 covers along with device placement and other architecture decisions that protect the infrastructure. A scenario that says administrators need remote access to servers through one controlled, audited point, or asks how to stop exposing RDP or SSH to the internet, points to a jump server or bastion host with MFA. On placement diagrams, its slot is the management zone. Distractors include moving RDP to a non-standard port, which only hides it from casual scans; a port forward from the internet straight to the server; and a VPN on its own, which protects the connection but does not create a single audited administrative path. Expect bastion host, jump box and jump server to be treated as the same thing.