How do I connect through an authorised SSH jump host?
The SSH -J option routes a connection through an authorised jump host to the final server. You need permission to use both hosts and network access from the jump host to the target. The final SSH session still verifies the target server’s identity.
Before you start
- Authorised accounts on the jump host and target.
- Approved forwarding and network reachability between them.
Instructions
1. Confirm the two access paths
Verify the jump host’s public endpoint and the target address reachable from it. The sample IPs are placeholders. Do not treat the ability to reach a bastion as permission to access other servers behind it.
2. Connect through the jump host
Use the actual accounts assigned at each hop.
ssh -J adminuser@198.51.100.20 adminuser@203.0.113.10The client authenticates to the jump host and then establishes the SSH connection to the target through it.
3. Keep identity settings separate
If the hosts use different keys or ports, define two explicit Host aliases and use the jump alias with -J. Inspect each alias using ssh -G. Agent forwarding is not required for ordinary ProxyJump and should not be added merely to make the example work.
Check the result
- Both hosts’ fingerprints match independently trusted records.
- The final hostname belongs to the target server, not the jump host.
Troubleshooting
- The jump login succeeds but target connection fails
- Check target routing, SSH port and the jump host’s permitted forwarding policy.
- The wrong key is offered at one hop
- Configure an IdentityFile for that host’s specific alias and verify it independently.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.