> For the servers themselves, you shouldn't be able to get to sshd unless you're coming from one of the approved bastion servers. What if there's a zero-day in

> For the servers themselves, you shouldn't be able to get to sshd unless you're coming from one of the approved bastion servers. What if there's a zero-day in your bastion service, whatever that is?