SSH Proxy Jump

Why use a jump host? A ProxyJump setup can simplify firewalling and improve security: instead of opening SSH to many servers (and allowing many different client IPs), you only allow SSH to the jump host (proxy.hiddenssh.com). Then your internal/target server (hiddenssh.com) can be firewalled to accept SSH only from the jump host. This reduces exposed surface area, makes IP allow-lists easier to manage, and centralizes access control and logging in one place.

Use -J (ProxyJump) to reach hiddenssh.com through the jump host proxy.hiddenssh.com:

ssh -J <jump_user>@proxy.hiddenssh.com <target_user>@hiddenssh.com

Example

ssh -J user@proxy.hiddenssh.com user@hiddenssh.com

Jump host on a non-default port

ssh -J user@proxy.hiddenssh.com:2222 user@hiddenssh.com

Target host on a non-default port

ssh -J user@proxy.hiddenssh.com -p 2201 user@hiddenssh.com

Specify an identity key

ssh -i ~/.ssh/id_ed25519 -J user@proxy.hiddenssh.com user@hiddenssh.com

Verbose debugging

ssh -vvv -J user@proxy.hiddenssh.com user@hiddenssh.com

Tip: Save it in ~/.ssh/config

Host hiddenssh
  HostName hiddenssh.com
  User user
  ProxyJump user@proxy.hiddenssh.com

Then connect with:

ssh hiddenssh