Bastion hosts are generally a bad idea. It's fundamentally much better to just harden every system You must be one of those people that don't make mistakes an

Bastion hosts are generally a bad idea. It's fundamentally much better to just harden every system You must be one of those people that don't make mistakes and only use bug-free software across their entire deployment. For the rest of us, DMZ's and bastion hosts are the only way to limit our attack surface to something that can be realistically managed.