SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Jump server</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Jump server</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div role="note" class="hatnote navigation-not-searchable">"Jump box" redirects here. For boxes used in jumping exercises, see <a href="Plyometrics" title="Plyometrics">Plyometrics</a>. For an apparatus for starting a vehicle, see <a href="Jump_start_(vehicle)#Other_methods" title="Jump start (vehicle)">Jump start (vehicle) § Other methods</a>.</div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1248332772">

/* start https://en.wikipedia.org/ */

.mw-parser-output .multiple-issues-text{width:95%;margin:0.2em 0}.mw-parser-output .multiple-issues-text>.mw-collapsible-content{margin-top:0.3em}.mw-parser-output .compact-ambox .ambox{border:none;border-collapse:collapse;background-color:transparent;margin:0 0 0 1.6em!important;padding:0!important;width:auto;display:block}body.mediawiki .mw-parser-output .compact-ambox .ambox.mbox-small-left{font-size:100%;width:auto;margin:0}.mw-parser-output .compact-ambox .ambox .mbox-text{padding:0!important;margin:0!important}.mw-parser-output .compact-ambox .ambox .mbox-text-span{display:list-item;line-height:1.5em;list-style-type:disc}body.skin-minerva .mw-parser-output .multiple-issues-text>.mw-collapsible-toggle,.mw-parser-output .compact-ambox .ambox .mbox-image,.mw-parser-output .compact-ambox .ambox .mbox-imageright,.mw-parser-output .compact-ambox .ambox .mbox-empty-cell,.mw-parser-output .compact-ambox .hide-when-compact{display:none}

/* end https://en.wikipedia.org/ */

</style>

<p>A <b>jump server</b>, <b>jump host</b> or <b>jump box</b> is a system on a <a href="Computer_network" title="Computer network">network</a> used to access and manage devices in a separate security zone. A jump server is a <a href="Hardening_(computing)" title="Hardening (computing)">hardened</a> and monitored device that spans two dissimilar security zones and provides a controlled means of access between them. The most common example is managing a host in a <a href="DMZ_(computing)" title="DMZ (computing)">DMZ</a> from trusted networks or computers.

</p>

<div class="mw-heading mw-heading2"><h2 id="Background">Background</h2></div>

<p>In the 1990s when co-location facilities became more common there was a need to provide access between dissimilar security zones. The jump server concept emerged to meet this need. The jump server would span the two networks and typically be used in conjunction with a proxy service such as <a href="SOCKS" title="SOCKS">SOCKS</a> to provide access from an administrative desktop to the managed device. As <a href="Tunneling_protocol#SSH" title="Tunneling protocol">SSH-based tunneling</a> became common, jump servers became the de facto method of access.

</p>

<div class="mw-heading mw-heading2"><h2 id="Implementation">Implementation</h2></div>

<p>Jump servers are often placed between a secure zone and a DMZ to provide transparent management of devices on the DMZ once a management session has been established. The jump server acts as a single audit point for traffic and also a single place where user accounts can be managed. A prospective administrator must log into the jump server in order to gain access to the DMZ assets and all access can be logged for later audit.

</p>

<p>A typical configuration is a hardened Unix (or <a href="Unix-like" title="Unix-like">Unix-like</a>) machine configured with <a href="SSH" class="mw-redirect" title="SSH">SSH</a> and a local <a href="Firewall_(computing)" title="Firewall (computing)">firewall</a>. An administrator connects to a target machine in the DMZ by making an SSH connection from the administrator's personal computer to the jump server and then using SSH forwarding to access the target machine.

</p><p>Using SSH port forwarding or an SSH-based tunnel to the target host allows the use of insecure protocols to manage servers without creating special firewall rules or exposing the traffic on the inside network.

</p>

<div class="mw-heading mw-heading3"><h3 id="Windows">Windows</h3></div>

<p>A typical configuration is a Windows server running <a href="Remote_Desktop_Services" title="Remote Desktop Services">Remote Desktop Services</a> that administrators connect to; this isolates the secure infrastructure from the configuration of the administrator's workstation.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> It is also possible to enable OpenSSH server on Windows 10 (build 1809 and later) and Windows Server editions 2019 & 2022.<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Security_risks">Security risks</h2></div>

<p>A jump server is a potential risk in a network's design.<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup> There are several ways of improving the security of the jump server, including:

</p>

<ul><li>Properly subnetting / segmenting the network,<sup id="cite_ref-Pompon_Vinberg_2021_4-0" class="reference"><a href="#cite_note-Pompon_Vinberg_2021-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup> and securing <a href="VLANs" class="mw-redirect" title="VLANs">VLANs</a> using a firewall<sup id="cite_ref-Hess_5-0" class="reference"><a href="#cite_note-Hess-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup> or router.</li>

<li>Using higher security authentication, such as <a href="Multi-factor_authentication" title="Multi-factor authentication">multi-factor authentication</a>.<sup id="cite_ref-Hess_5-1" class="reference"><a href="#cite_note-Hess-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup></li>

<li>Keeping the operating system and software on the jump server up to date.<sup id="cite_ref-Applied_Risk_2021_6-0" class="reference"><a href="#cite_note-Applied_Risk_2021-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup></li>

<li>Using <a href="Access_control_list" class="mw-redirect" title="Access control list">ACLs</a> to restrict access.<sup id="cite_ref-Intelligent_Systems_Monitoring_2018_7-0" class="reference"><a href="#cite_note-Intelligent_Systems_Monitoring_2018-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup></li>

<li>Not allowing outbound access to the rest of the internet from the jump server.<sup id="cite_ref-NERC_2011_8-0" class="reference"><a href="#cite_note-NERC_2011-8"><span class="cite-bracket">[</span>8<span class="cite-bracket">]</span></a></sup></li>

<li>Restricting which programs can be run on the jump server.<sup id="cite_ref-Grimes_2017_9-0" class="reference"><a href="#cite_note-Grimes_2017-9"><span class="cite-bracket">[</span>9<span class="cite-bracket">]</span></a></sup></li>

<li>Enabling strong logging for monitoring and alerting of suspicious activity.<sup id="cite_ref-Applied_Risk_2021_6-1" class="reference"><a href="#cite_note-Applied_Risk_2021-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup></li></ul>

<p>With the high level of risk that a jump server can represent, a <a href="VPN" class="mw-redirect" title="VPN">VPN</a> may be a suitable and higher security replacement.<sup id="cite_ref-10" class="reference"><a href="#cite_note-10"><span class="cite-bracket">[</span>10<span class="cite-bracket">]</span></a></sup>

</p><p>In 2015, a compromised jump server allowed attackers access to over 21.5 million records in one of the <a href="Office_of_Personnel_Management_data_breach" title="Office of Personnel Management data breach">largest breaches of government data in the history of the United States</a>.<sup id="cite_ref-11" class="reference"><a href="#cite_note-11"><span class="cite-bracket">[</span>11<span class="cite-bracket">]</span></a></sup>

</p>

<ul><li><a href="Bastion_host" title="Bastion host">Bastion host</a></li>

<li><a href="Proxy_server" title="Proxy server">Proxy server</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-secure-administrative-hosts">"Implementing Secure Administrative Hosts"</a>. <i>docs.microsoft.com</i>. 29 July 2021.</cite></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite id="CITEREFrobinharwood" class="citation web cs1">robinharwood. <a rel="nofollow" class="external text" href="https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse">"Get started with OpenSSH for Windows"</a>. <i>learn.microsoft.com</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2022-12-02</span></span>.</cite></span>

</li>

<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><cite id="CITEREFGrimes2017" class="citation web cs1">Grimes, Roger A. (July 26, 2017). <a rel="nofollow" class="external text" href="https://www.csoonline.com/article/2612700/security-jump-boxes-improve-security-if-you-set-them-up-right.html">"'Jump boxes' and SAWs improve security, if you set them up right"</a>. <i>CSO Online</i>.</cite></span>

</li>

<li id="cite_note-Pompon_Vinberg_2021-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-Pompon_Vinberg_2021_4-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFPomponVinberg2021" class="citation web cs1">Pompon, Raymond; Vinberg, Sander (2021-09-21). <a rel="nofollow" class="external text" href="https://www.f5.com/labs/articles/cisotociso/protecting-critical-systems-with-isolation-and-jump-boxes">"Protecting Critical Systems with Isolation and Jump Boxes - F5 Labs"</a>. <i>F5 Labs</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2022-01-28</span></span>.</cite></span>

</li>

<li id="cite_note-Hess-5"><span class="mw-cite-backlink">^ <a href="#cite_ref-Hess_5-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Hess_5-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><cite id="CITEREFHess" class="citation web cs1">Hess, Ken. <a rel="nofollow" class="external text" href="http://www.linux-magazine.com/Online/Features/Jump-Box-Security">"Jump Box Security » Linux Magazine"</a>. <i>Linux Magazine</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2022-01-28</span></span>.</cite></span>

</li>

<li id="cite_note-Applied_Risk_2021-6"><span class="mw-cite-backlink">^ <a href="#cite_ref-Applied_Risk_2021_6-0"><sup><i><b>a</b></i></sup></a> <a href="#cite_ref-Applied_Risk_2021_6-1"><sup><i><b>b</b></i></sup></a></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://applied-risk.com/resources/4-ot-it-network-segmentation-techniques-selecting-a-cyber-resilient-configuration">"4 OT/IT network segmentation techniques - selecting a cyber resilient configuration- Applied Risk"</a>. <i>Applied Risk</i>. 2021-11-24<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-01-28</span></span>.</cite></span>

</li>

<li id="cite_note-Intelligent_Systems_Monitoring_2018-7"><span class="mw-cite-backlink"><b><a href="#cite_ref-Intelligent_Systems_Monitoring_2018_7-0">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://intelligentsystemsmonitoring.com/tag/jump-server/">"Jump server"</a>. <i>Intelligent Systems Monitoring – Systems Monitoring Made Easy</i>. 2018-05-03<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-01-28</span></span>.</cite></span>

</li>

<li id="cite_note-NERC_2011-8"><span class="mw-cite-backlink"><b><a href="#cite_ref-NERC_2011_8-0">^</a></b></span> <span class="reference-text"><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.nerc.com/fileUploads/File/Events%20Analysis/FINAL-Guidance_for_Secure_Interactive_Remote_Access.pdf">"Guidance for Secure Interactive Remote Access"</a> <span class="cs1-format">(PDF)</span>. <i>North American Electric Reliability Corporation</i>. 2011-08-24. p. 38<span class="reference-accessdate">. Retrieved <span class="nowrap">2022-01-28</span></span>.</cite></span>

</li>

<li id="cite_note-Grimes_2017-9"><span class="mw-cite-backlink"><b><a href="#cite_ref-Grimes_2017_9-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFGrimes2017" class="citation web cs1">Grimes, Roger A. (2017-07-26). <a rel="nofollow" class="external text" href="https://www.csoonline.com/article/2612700/security-jump-boxes-improve-security-if-you-set-them-up-right.html">"'Jump boxes' and SAWs improve security, if you set them up right"</a>. <i>CSO Online</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2022-01-28</span></span>.</cite></span>

</li>

<li id="cite_note-10"><span class="mw-cite-backlink"><b><a href="#cite_ref-10">^</a></b></span> <span class="reference-text"><cite id="CITEREFBhargava2014" class="citation web cs1">Bhargava, Rajat (January 10, 2014). <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190422000000/http://radar.oreilly.com/2014/01/is-the-jump-box-obsolete.html">"Is the Jump Box Obsolete?"</a>. <i>O'Reilly Radar</i>. Archived from <a rel="nofollow" class="external text" href="http://radar.oreilly.com/2014/01/is-the-jump-box-obsolete.html">the original</a> on 2019-04-22.</cite></span>

</li>

<li id="cite_note-11"><span class="mw-cite-backlink"><b><a href="#cite_ref-11">^</a></b></span> <span class="reference-text"><cite id="CITEREFKoerner2016" class="citation magazine cs1">Koerner, Brendan (October 23, 2016). <a rel="nofollow" class="external text" href="https://www.wired.com/2016/10/inside-cyberattack-shocked-us-government/">"Inside the Cyberattack That Shocked the US Government"</a>. <i>Wired</i>.</cite></span>

</li>

</ol></div></div>

<div class="mw-heading mw-heading2"><h2 id="External_links">External links</h2></div>

<ul><li><cite id="CITEREFWimmer" class="citation web cs1">Wimmer, Peter Kai. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20160308235020/https://www.atsec.de/fileadmin/user_upload/whitepaper/ISSE_2009-Secure_network_zones-Peter_Wimmer.pdf">"Secure Network Zones"</a> <span class="cs1-format">(PDF)</span>. <i>ATSEC Information Security</i>. Archived from <a rel="nofollow" class="external text" href="http://www.atsec.de/fileadmin/user_upload/whitepaper/ISSE_2009-Secure_network_zones-Peter_Wimmer.pdf">the original</a> <span class="cs1-format">(PDF)</span> on 2016-03-08.</cite></li>

<li><cite id="CITEREFMathis2004" class="citation web cs1">Mathis, Roland (2004-09-20). <a rel="nofollow" class="external text" href="https://www.giac.org/paper/gcux/266/installation-secure-user-chrooted-ssh-jumphost/106535">"Installation of a Secure User-Chrooted SSH Jumphost"</a> <span class="cs1-format">(PDF)</span>. <i>GIAC</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2019-06-12</span></span>.</cite></li></ul></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-05-12" href="https://en.wikipedia.org/wiki/?title=Jump_server&oldid=1290110452">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>