You could ask similar questions about all the layers. Why is any of this needed at all? Direct SSH connections from Internet-based clients to target hosts coul

You could ask similar questions about all the layers. Why is any of this needed at all? Direct SSH connections from Internet-based clients to target hosts could be secured in principle if you believe in your SSH key management (perhaps even using some MFA strategy). An SSH tunnel is pretty analogous to an authenticated web or SOCKS proxy. You usually use such a thing to selectively work around firewall or routing obstacles, or to inject yet another layer of authn+authz+audit for different traffic classes. So, working bottom-up, you can probably interpret your company's layer cake as: - Presumably you are using SSH because it is the native protocol for your actual target systems' OS. - Having a proxy tunnel for SSH helps when target hosts are in otherwise non-routed subnets. - They believe in a virtual desktop strategy as a way to avoid trust in end-user client systems. - They use RDP over VPN because they don't trust RDP over the Internet. Different schools of thought will see some or all of these layers as necessary best practice or as delusional cargo culting. As native user of SSH for almost 30 years, I think the whole virtual desktop approach is a travesty. I would not want to have any SSH credentials being stored in a virtual PC outside my physical control. But I know I am not going to convince a typical CIO of that.