Jumpboxes aren&#x27;t that bad to automate, actually.<p>We already help with automating jumpbox creation. (docs: <a href="https:&#x2F;&#x2F;userify.com&#x2F;docs&#x2F;tips&#x2F;jumpbox&#x2F;" rel="nofollow">https:&#x2F;&#x2F;userify.com&#x2F;docs&#x2F;tips&#x2F;jumpbox&#x2F;</a>) and we&#x27;re building even more jumpbox automation now. Don&#x27;t allow root for any jumpbox accounts, but of course root escalation exploits abound. (I just found another in an AWS agent yesterday.)<p>Of course, as another commenter mentioned, if your jumpbox is compromised, than the jumpbox could serve as a gateway to your network. It&#x27;s a tradeoff between exposing all of your servers to inbound SSH or only one.<p>There&#x27;s another way, which is pure TCP forwarding on a different port for each server (ie 21321 -&gt; inner server 22), but whether this actually reduces the attack surface is debatable, since the totality of open ports remains the same across the entire network.<p>My personal feeling is that using a jumpbox and locking it down (preferably to your company&#x27;s IP ranges, etc) is the best way to go. You can also add MFA to the jumpbox entry point itself. We&#x27;re going to help with automating all of that in the near future, too.<p>(disclaimer: CTO @Userify)