Let's say, for example, a company has a "centralised" SSH bastion/jump host on an untrusted server (e.g. a virtual machine in "the cloud").

Meanwhile the corporate/customer/whatever network(s) have firewall ACLs permitting SSH traffic from the bastion/jump host to the internal SSH server(s).

Is it possible for an evil actor to exploit the jump host to enable viewing of SSH traffic ? Or is the traffic that flows over the jump host always end-to-end encrypted ? (i.e. the bastion/jump host always just sees an encrypted flow because the traffic between client and internal server uses the internal server's keypair).

For the avoidance of doubt over terminology, when I talk about jump host I'm talking about commands such as :

ssh -J bastion.example.com internal.example.com


scp -oProxyJump=bastion.example.com internal.example.com


From man ssh

     -J [user@]host[:port]
         Connect to the target host by first making a ssh connection to
         the jump host and then establishing a TCP forwarding to the ulti-
         mate destination from there.  Multiple jump hops may be specified
         separated by comma characters.  This is a shortcut to specify a
         ProxyJump configuration directive.

As it is creating a TCP tunnel from your computer, through the jump host, to the target, two ssh connections will be established, one to the jumphost, and another one inside the tunnel. The one inside the tunnel will be encrypted.

The jumphost could hijack the connection target, but then the key will not match.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.