ProxyJump: The Secure Way to SSH Through a Bastion Host Without Exposing Keys

Most production networks use a bastion host as the sole internet-facing gateway, with internal servers sitting on a private network behind it. Two common methods of traversing this gateway — copying private keys to the bastion or using SSH agent forwarding — introduce serious security risks by exposing credentials on the jump host. ProxyJump (ssh -J) solves this by tunneling a second SSH connection through the bastion, so authentication to the target server happens end-to-end from the user's own machine. The bastion only relays encrypted bytes and never has access to the user's key or agent socket. Multiple hops can be chained with comma-separated hostnames, and the setup can be simplified further using SSH config file entries to make routing transparent.