I have some 30 Media Temple grid servers and I need to manage the access of 15 or so developers to those servers. Is it possible, and more importantly secure, to setup a server who's only job is to serve as a proxy. The devs would log into that server and from there they can set up a tunnel to their destination. I want to set it up so that they will not need to know the passphrase or have an RSA key for the final target server - these would be stored on the authentication server. They would log into the proxy with their own username and password, and if their access to the auth server is severed they won't be able to log in to any of the grid servers. The proxy would log all traffic that crosses it. As a final hardening step I'd like to set up the grid servers to not accept ssh login attempts from anywhere but the IP of the authentication server.

I can manage the laptops of the devs to change their ssh config files if needed.

Is this plan feasible and is it secure?

  • can you use Kerberos/GSSAPI for this? Apr 25, 2016 at 17:34

1 Answer 1


Yes, you can do this; this sort of setup is commonly referred to as a bastion host or jump host.

However, when implementing any security practice, it's useful to build an explicit threat model: what attacks are you trying to protect against? A current employee from doing things they shouldn't (perhaps accidentally)? A former employee using old credentials to access the system? An outside attacker forcing their way into the system?

You must log in to answer this question.