Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In order to access a Linux host through a firewall/NAT I am required to use an SSH "bounce host". I am concerned with the possibility that this bounce host may be logging my SSH session. In a test environment I am able to log anything that is displayed on the console, including screen sessions.

What steps can I take to ensure that my SSH session will be secure/private if this bounce host does indeed perform logging?

share|improve this question
Are you the administrator of the bounce host ? – Iain Jan 7 '14 at 22:34
Why would you even have an interactive session on the bounce host, instead of just tunneling through it? – andol Jan 7 '14 at 23:05
Use IPv6 and connect directly to your destination. – Michael Hampton Jan 8 '14 at 0:51
No not the admin and the only way to access is using IPv4 and the bounce host. – Tuaris Jan 14 '14 at 21:14

It depends on how exactly you are using this bounce host.

If you use ProxyCommand, or Netcat mode (in OpenSSH 5.4+) there are basically two separate encrypted connections. One between you and the bounce host, and a completely separate connection between your local client and the far host. In this mode the only thing the intermediate host would know is that you ran where using it as a proxy.

If on the other hand you are just connecting to the intermediate host, and then launching an ssh connection from that host to the far host, then yes, potentially everything you do could be monitored.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.