A bastion host is one of those pieces of infrastructure that is easy to explain and surprisingly easy to get slightly wrong. You have a private server, database node, router, lab machine, or management host that should not be reachable from the open internet. Instead of exposing SSH on every …