Reaching a device through a jump host

Some equipment is only reachable from a bastion — a management box on the inside, or a firewall that only lets one address through. The app does what ssh -J does: it authenticates to the jump host first, then opens the connection to the target from there, inside that session.

Setting it up

1. Save the bastion as an ordinary SSH connection and check that it connects on its own.
2. On the target’s form, pick that entry under Jump host. The list shows saved SSH connections that connect directly.
3. Fill in the target’s own host, username and credential — these are checked by the target, not by the bastion. Save.

File Transfer has the same control, so a config can be pulled off a device behind the bastion as easily as a terminal opened on it.

What happens on connect

The bastion’s host key and the target’s are both pinned and both checked; a change on either is refused. The credential stored for the bastion is used for the bastion, and the target’s for the target. Nothing is forwarded except the one connection you asked for.

Limits

• One hop. A jump host cannot itself go through a jump host, and the form will not offer one that does.
• This is not port forwarding. There is no -L, -R or SOCKS; the hop carries one SSH or SFTP session and nothing else.