SSH in Depth: ~/.ssh/config, ProxyJump Through a Bastion, Port Forwarding to a Remote Database and the Risk of Agent Forwarding
Hop to private servers through a bastion with ProxyJump, not ssh -A: with agent forwarding on, someone who is root on the bastion can log into the database server with your key, and ControlPersist keeps that window open for minutes. We cover the first-value-wins rule of ~/.ssh/config, Match and ControlMaster, tunnels with -L, -R and -D, narrowing the bastion with AllowTcpForwarding and PermitOpen, FIDO2 keys and SSH certificates, with real output.
15 Nov 2026
·
12 min
·
12
