Bastion host

What it means

A bastion host is a server placed at the edge of a private network whose only job is to let administrators in. Everyone who needs to reach internal machines goes through it, and the internal machines accept connections from nothing else.

Because there is one entrance, you can harden it heavily, watch it closely and log everything that passes through. It runs almost nothing else. The idea is to guard a single door well rather than leave many doors lightly guarded.

Why it matters

Without one, each internal server may expose its own admin port to the internet, such as SSH or remote desktop. Automated scanners find those within hours, and every extra open port is another password to guess or another unpatched service.

A bastion also gives you a clear record of who reached what and when, which helps with audit trails and with proving least privilege. If it is poorly kept, though, it becomes a single high-value target, because it leads everywhere.

How it shows up

You meet it as the jump server in a cloud network: sit in a public subnet, allow admin connections only from known addresses, and forward onwards to private machines. Many teams now use managed session services instead, which remove the always-on public server.

The usual faults are shared accounts, password sign-in instead of keys, stale software, wide-open source address ranges and no multi-factor authentication. Also check that internal servers truly refuse direct admin connections, and that logs from the bastion are kept elsewhere.