25

What's are the differences/similarities between a "bastion host" and a "jump host"? Are they usually used interchangeably?

1 Answer 1

23

A Bastion host is a machine that is outside of your security zone.
And is expected to be a weak point, and in need of additional security considerations.

Because your security devices are technically outside of your security zone, firewalls and security appliances are also considered in most cases Bastion hosts.

Usually we're talking about:

  • DNS Servers
  • FTP Servers
  • VPN Servers

A Jump Server is intended to breach the gap between two security zones.

The intended purpose here is to have a gateway to access something inside of the security zone, from the DMZ.
The main reason I've seen this utilized is to make sure that the one known entrance to a specific server that has to be accessible from the outside is kept up to date and is known in its purpose as only having to connect to (a) specific host(s).

Usually this is a hardened Linux box only used for SSH.

4
  • The difference seems subtle -- isn't a VPN server intended to breach the gap between two security zones? This article seems to imply that a jump host is a type of bastion host.
    – jhfrontz
    Jun 27, 2016 at 15:01
  • 5
    @jhfrontz The main difference as I understand and use it, is that a jump host is used for remote access. And Bastion hosts offer services that need to face the internet. Look at jump hosts as border guards, and bastion hosts as a tellers window at a bank. You can get services from the teller, but you don't access the bank. On the other hand once past the border checkpoint you're inside the country.
    – Reaces
    Jun 30, 2016 at 21:23
  • I get how the other two (DNS and FTP servers) conform to the teller analogy but I thought the VPN server was listed as an example of a bastion host -- I was thinking that a VPN server is for offering remote access (i.e., a border guard). Or is the suggestion that a VPN connection is a "service" (and that connectivity to points on the internal network can be limited) vs. access?
    – jhfrontz
    Jul 1, 2016 at 0:42
  • 2
    @jhfrontz The reasoning here is that the vpn server isn't the one you connect to. It creates the tunnel you use to connect with. But you generally don't ssh into your vpn enabled firewall :)
    – Reaces
    Jul 1, 2016 at 5:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .