Jump server

A jump server, jump host or jump box is a system on a network used to access and manage devices in a separate security zone. A jump server is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them. The most common example is managing a host in a DMZ from trusted networks or computers.

A jump server, jump host or jump box is a system on a network used to access and manage devices in a separate security zone. A jump server is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them. The most common example is managing a host in a DMZ from trusted networks or computers. ==Background== In the 1990s, when co-location facilities became more common, there was a need to provide access between dissimilar security zones. The jump server concept emerged to meet this need. The jump server would span the two networks and typically be used in conjunction with a proxy service such as SOCKS to provide access from an administrative desktop to the managed device. As SSH-based tunneling became common, jump servers became the de facto method of access. ==Implementation== Jump servers are often placed between a secure zone and a DMZ to provide transparent management of devices on the DMZ once a management session has been established. The jump server acts as a single audit point for traffic and also a single place where user accounts can be managed. A prospective administrator must log into the jump server in order to gain access to the DMZ assets, and all access can be logged for later audit. ==Security risks== A jump server is a risk in a network's design. There are several ways of improving the security of the jump server, including: Properly subnetting / segmenting the network, and securing VLANs using a firewall or router. Using higher security authentication, such as multi-factor authentication. Keeping the operating system and software on the jump server up to date. Using ACLs to restrict access. Not allowing outbound access to the rest of the internet from the jump server. Restricting which programs can be run on the jump server. Enabling strong logging for monitoring and alerting of suspicious activity. When enhanced security features are required, such as policing client environments, a VPN may be a suitable replacement. ==See also== Bastion host Proxy server ==References== ==External links==

Text derived from https://en.wikipedia.org/w/index.php?oldid=1351846589 under CC BY-SA 4.0; modifications have been made.