Quick answer: A bastion host (jump server) is the single, controlled door for management access to an internal network or servers. Instead of connecting directly to servers, administrators first connect to this hardened single point and from there move to internal systems. This way none of the internal servers are directly exposed to the internet, all access passes through a single auditable point and is logged. It is a fundamental component of zero trust architecture and secure remote access.

Why is a bastion host needed?

Exposing management access (SSH, RDP) to the internet separately on each server creates a broad and hard to control attack surface. Every open management port is a separate target. A bastion host reverses this problem: management access to internal servers is fully closed to the outside, and only a single hardened jump server is reachable in a controlled way.

This single point both narrows the attack surface and makes all management access auditable and loggable in one place. The question of who connected to which server and when is answered at a single point.

Bastion host design principles

Principle Description
Single entry point Access to internal servers only through the bastion
Strong hardening The bastion should be the most tightly hardened server
Strong authentication Key based login and multi factor authentication
Least privilege Minimum software and privilege on the bastion
Full logging Audit logging of all sessions and commands
Internal isolation Internal servers closed to the internet directly

Modern alternatives: VPN, ZTNA and tunnels

A classic bastion host is a single hardened server. Modern approaches extend this idea: ZTNA (zero trust network access) connects the user not to the whole network but only to the needed system; zero external port tunnels carry management access to the outside without any open port. They all share the same principle: not exposing internal systems directly to the internet and routing access through a single, auditable door.

The KAOS and DSET approach

DSET evaluates organizations' management access architecture: are internal servers directly exposed to the internet, does access pass through a single auditable point. Our KAOS security engine detects directly exposed management ports (SSH, RDP) during external attack surface scans. In our field experience the most common problem is each server's management port being separately exposed to the internet. Our goal is to show the way to narrow management access down to a single auditable door.

Related reading: SSH server security and hardening, VPN security and ZTNA, zero trust architecture, network segmentation and microsegmentation, SASE and SSE secure access service edge, PAM privileged access management.

Frequently asked questions

What is the difference between a bastion host and a VPN? A VPN joins the user to a network and provides access to systems on that network. A bastion host is the single, controlled jump point for access to specific servers. They can be used together: enter the network with the VPN, move to critical servers through the bastion. The modern ZTNA approach narrows this logic further by connecting the user not to the whole network but only to the needed system.

Is a bastion host not a single point of failure? Being a single point for access is a deliberate design, because it makes all management access auditable. For reliability it is supported with redundancy (a second bastion). For security the bastion should be the most tightly hardened server, because all access passes through it. When set up correctly, being a single point is a control advantage, not a weakness.

Does a small organization need a bastion host? Any organization with several servers standing with internet exposed management ports benefits from narrowing access to a single controlled point. For small organizations, instead of a full bastion architecture, a zero external port tunnel or a ZTNA solution can provide the same principle (not exposing internal systems directly) in a simpler way.

Sources

To evaluate your management access architecture and pull your internal servers off the direct internet, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.