I will never understand people who think a bastion host or "jump box" is a good idea. I've seen so many companies that have experienced extended downtime becaus

I will never understand people who think a bastion host or "jump box" is a good idea. I've seen so many companies that have experienced extended downtime because they had an issue and it also broke their jumpbox - so nothing could be fixed until their bastion host was fixed. Plus, the companies I've bought that used bastion hosts ended up having the worst security on the jumpbox machine because it's a "set it and forget it" machine that isn't normally treated like a production server. I've seen bastion hosts that had root kits for years and nobody noticed because they never really logged in to look around at the bastion host itself. I've never understood the appeal, nor have I seen anyone do it well, honestly. It seems to get mentioned in all of these novice and semi-pro SSH related articles as a good idea and just makes my eye twitch when I see it.