How do I SSH through a bastion host from a browser?
ProxyJump without a laptop, and without the bastion ever seeing the credentials for the target.
What you are running into
Production is only reachable through a bastion. On your workstation that is a ProxyJump line in ~/.ssh/config. On anything else, a phone, a tablet, a borrowed machine, it means two hops by hand and a key copied somewhere it should not be.
Browser SSH tools that run the client on their server make it worse: now their server holds the bastion key and the target key.
How SSH Guru handles it
Two hops, one client, in your tab
The in-browser SSH client dials the bastion, then opens the inner connection to the target through it, the same way ProxyJump does.
The bastion never sees the target key
The inner SSH session is encrypted end to end from your browser to the target. The bastion forwards ciphertext.
Both host keys pinned
Bastion and target host keys are remembered on first use and checked in the browser. A changed key warns you before anything is sent.
What to do, step by step
- Upgrade to Pro
Jump hosts are a Pro feature. Everything else on this page works on the free plan.
- Add the bastion as a server
Its public hostname, port, username and key. The key is encrypted in your browser before it is stored.
- Add the target
Its internal address, and in the route section choose the bastion as the jump host. Paste the target's key or password.
- Connect
One click opens both hops. The terminal is the target's; the Guru can help there like on any server.
Questions
Can I chain more than one jump?
One jump host per target today.
Does the bastion need agent forwarding enabled?
No. Nothing is forwarded; the client opens a direct-tcpip channel through the bastion, which most bastions allow by default.
Does it work with a key that has a passphrase?
Yes. The key passphrase is stored in your vault next to the key, encrypted in the browser like everything else.