A better alternative would be ProxyJump. See e.g. https://serverfault.com/questions/958222/bastion-server-use-tcp-forwarding-vs-placing-private-key-on-server ht

A better alternative would be ProxyJump. See e.g. https://serverfault.com/questions/958222/bastion-server-use-tcp-forwarding-vs-placing-private-key-on-server https://serverfault.com/questions/958222/bastion-server-use-... Edit: To add some details - using ProxyJump you don’t have to expose anything to the jump host and instead just proxy through it.