Network › Module 4 › Lesson 2
Jump Hosts and Bastions as Ideas
Admin should not knock on the jewel — then practice a two-step on then :8793.
Visual · jump_host_bastion
A jump/bastion is a controlled admin door. http://192.168.0.1/ YOUR lab. Two-step loopback 8783→8793.
Opening
If every laptop on Wi-Fi can SSH the database, you do not have a DMZ. You have a suggestion.
A jump host (bastion) is a machine — or a tightly controlled service — that admins use as the allowed hop into interior systems. Strangers still only see the public role. Admins do not expose RDP/SSH from the world to the app server; they authenticate to the jump, then continue. The idea fails when the jump is a shared password on a yellow box that also hosts WordPress. Original Cyberlium.
1. Admin path is a named hop, not “VPN vibes”
Bastion thinking is allowlisting who may start an admin session, from where, to what dest. A VPN can be part of that path. A VPN that dumps you onto a flat inside VLAN is just a longer ethernet cable. Write the hop: human → jump → app. Public users never receive the jump credential.
. If 192.168.0.1 is a router, STOP — do not enable remote admin or WAN SSH as a “bastion lab.” Your hop stays loopback HTTP dests you will own in the lab.
2. Two-step on loopback: public first, app second
You curl 8783, save a token-like header or body line if the toy offers one, then curl 8793. Even if today’s toys are not wired as a real proxy, the operator habit is the lesson: do not bookmark the interior dest as if it were public. When the lab starts both listeners, this order stays.
Do not skip to 8793 from a café and call it efficiency. Do not bind 8793 on 0.0.0.0 “so jump is optional.”
Command guide
Two-step on loopback: public first, app second
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install nmap sudo apt install python3
macOS:
Command — copy this
brew install nmap brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
curl -sS -m 2 -D "$HOME/cyberlium-lab/t11-m04-public.hdr" -o "$HOME/cyberlium-lab/t11-m04-public.body" "http://127.0.0.1:8783/"
curl -sS -m 2 -o "$HOME/cyberlium-lab/t11-m04-app.body" "http://127.0.0.1:8793/"
head -n 12 "$HOME/cyberlium-lab/t11-m04-public.hdr"
head -n 5 "$HOME/cyberlium-lab/t11-m04-app.body"
python3 - << 'PY'
import socket
for port in (8783, 8793):
s = socket.socket(); s.settimeout(0.4)
print("127.0.0.1:%s" % port, s.connect_ex(("127.0.0.1", port)))
s.close()
PY3. Shared jump passwords are a second DMZ failure
A bastion with one password in a wiki is a piñata. Prefer unique credentials, short sessions, and logging on the jump. This course will not teach you to hydra a jump, brute a router’s remote admin, or BeEF a login page.
Record: hop order, dests 8783 then 8793, refuse WAN SSH. chmod 600.
Command guide
Shared jump passwords are a second DMZ failure
═══ COMMANDS ═══
Command — copy this
grep "8793" "$HOME/cyberlium-lab/t11-m04-hop.txt"
4. What you ship: a written hop order and two loopback dests, not an open admin port
human→8783→8793 on disk. DEMO GATE. No WAN remote admin. No hydra. No 0.0.0.0 SSH. Two-step curls if toys are up.
5. What you record before the next lesson
Date. Jump = named admin hop. Public 8783 then app 8793. DEMO identified/STOP. NEVER hydra/nmap/0.0.0.0. File t11-m04-l02-jump-hosts.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Expose 3389/22 on the app VM to the world. Hydra the bastion “to test.” Enable TP-Link remote management.
Right
Write the hop. Curl public then app on loopback. Next: What Never Belongs in a DMZ.
Mission: practice admin as a second dest, not a public bookmark
1) / STOP if router. 2) Write hop human→8783→8793. 3) Curl then :8793 if up. Do not open WAN admin. Do not hydra.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why a VPN onto a flat VLAN is not a bastion — not how to port-forward SSH from a café.
Knowledge Check
APPLY: Database SSH is published to 0.0.0.0 because “we have a DMZ.” Cyberlium says:
Multiple choice
Knowledge Check
APPLY: True or False: Enabling WAN remote admin on 192.168.0.1 is this lesson’s jump-host lab.
True or False
Knowledge Check
APPLY: You curl 8793 first because it is “faster.” What habit broke?
Multiple choice