Jump Server Security Best Practices

A Jump Server runs on a Linux host in your own environment. It sits between your users and the resources they open in JumpCloud Privileged Access Management (PAM). Because of this role, the host needs the same care as any other privileged system.

Important

You own the security of the host. JumpCloud runs PAM in the cloud. You run the Linux host, its network, and its updates. JumpCloud cannot maintain or secure that host for you.

Preparing the Host

1. Use a dedicated host. Do not run other services on the same host as the Jump Server.
2. Meet the host requirements. Check the operating system, CPU, memory, and disk values in Install PAM Jump Server.
3. Place the host in a secured network segment. Keep it away from public networks and from users who do not need it.
4. Keep the host clock in sync. Use a time server. The clock must stay within 300 seconds of JumpCloud server time.

Controlling Access to the Host

1. Limit access to the staff who need it. Remove permissions that are no longer needed.
2. Use one Admin account per person. Do not use generic or shared accounts. Each action on the host must trace back to one person.
3. Log in only for maintenance. When possible, open the session to the host through JumpCloud PAM.
4. Use SSH keys instead of passwords. Turn off password login, as described in the next section.
5. Treat Docker access like root access. Do not add accounts to the docker group unless they need it.

Hardening SSH Access

Two changes make SSH access to the host much harder to attack. Turn off root login, then turn off password login. Complete the steps in order.

warning

Do not lock yourself out. Keep your current SSH session open while you change these settings. Open a second session and confirm that you can log in before you close the first one.

Turning Off Root Login

1. Log in as a regular user. Confirm that sudo works for this user.
2. Open the SSH configuration file:

sudo nano /etc/ssh/sshd_config

3. Set this value:

PermitRootLogin no

4. Save the file, then restart the SSH service:

sudo systemctl restart ssh

Turning Off Password Login

1. Add the public SSH key of each Admin to ~/.ssh/authorized_keys for that Admin’s account.
2. Open a new session and confirm that the key login works.
3. In /etc/ssh/sshd_config, set these values:

PubkeyAuthentication yes
PasswordAuthentication no

4. Save the file, then restart the SSH service:

sudo systemctl restart ssh

5. Check the active settings:

sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication'

6. On some images, files in /etc/ssh/sshd_config.d/ override the main file. Check them if a setting does not apply.

Limiting Network Access

Isolate the Jump Server host in its own network segment. Allow only the network connections it needs, and block everything else with your firewall.

Direction	Port	What to allow
Inbound	Web Port (default 443)	Browser sessions. Allow only the networks where your users connect, such as your office, VPN, or zero trust network access (ZTNA).
Inbound	Shell Port (default 2222)	Direct Access. Use the same rule as the Web Port.
Inbound	22	Admin SSH to the host. Keep this port closed. Open it only during maintenance, from your Admin network, and close it when you finish.
Outbound	443	JumpCloud PAM cloud addresses for your data center.
Outbound	5671	Message queue for live commands from JumpCloud PAM, such as forcing a user to disconnect.
Outbound	Resource ports	The ports of the resources you share, such as SSH, RDP, and database ports. Allow only the resources you added to JumpCloud PAM.

The Web Port and Shell Port are the values you set when you added the Jump Server. For the full list of cloud addresses by data center, see Install PAM Jump Server.

Turn on detailed firewall logging, and review the logs. This helps you find and respond to access attempts you do not expect.

Protecting Data on the Host

1. Watch free disk space. Session recordings and transferred files use disk space on the host. A full disk can stop recordings and transfers.
2. Protect your Backup Key. If you use Jump Server Backup, the host keeps daily encrypted backups. Store the Backup Key in a secure company location, and limit who can open backups. See Configure Jump Server Credentials Backup.

warning

Do not remove Docker volumes by hand. This can delete session recordings that are not uploaded yet, the SSH keys of the Jump Server, and its certificates. Use the install file from the JumpCloud Admin Portal to install or reinstall.

Keeping the Host Updated and Monitored

1. Patch the operating system. Apply updates and security patches on a regular schedule.
2. Update the Jump Server. Run a current version. See Update PAM Jump Server.
3. Monitor the host. Add it to your monitoring and logging tools, so your team sees problems early.
4. Check Jump Server health. In the JumpCloud Admin Portal, go to Access > PAM > Jump Servers. Confirm that the status is healthy, or click Health Check from Actions for details.