How to use a jump host on a Mac

Visual ProxyJump configuration, agent forwarding, multi-hop chains — without editing ~/.ssh/config every time.

Estimated time: 3 minutes

A jump host (bastion) is a single Internet-exposed SSH server through which you reach private hosts in a network. Set up a bastion once, every other server is reachable via it. The OpenSSH way is `ssh -J bastion target` or `ProxyJump bastion` in `~/.ssh/config`. SSHive makes it visual: configure the bastion as a profile, then tag any other profile with "Jump Host: bastion" — no config-file editing.

Step-by-step

1
Create the bastion profile first (it has no jumps itself)
Sidebar → + → SSH. Fill the bastion's public hostname/IP, port, user, auth (key recommended). The Advanced section is left empty for the bastion — it has no Jump Chain itself. Save and connect once to accept the host key. Reason this matters: SSHive's Jump Host UI is **a dropdown that lists existing SSH profiles** — there is no free-text "user@host" field, so the bastion profile must exist before any profile can reference it.
2
Build the chain on the target profile (Pro only)
Create a new SSH profile for the target. Fill its **private** address (as seen from inside the bastion's network) and the auth that the target itself accepts. Click **Advanced** → **Jump Chain** block. Click **+ Add hop** — a `<select>` appears listing all your other SSH profiles (filtered to type = ssh, excluding the current one). Pick the bastion. The chain visualizes at the bottom: `bastion → target`. Each hop has up/down/remove buttons. Save. Jump Host is **Pro-only** (`LicenseService.check('jumphost')`); in Free the whole block is greyed and shows the PRO badge.
3
Each hop carries its own auth — no agent juggling required
Unlike OpenSSH `ProxyJump` (which needs an agent or matching keys to chain auth), every profile in SSHive's chain has its own auth — password / private key / agent / passphrase — and SSHive uses each profile's auth as it walks the chain. Bastion uses ed25519, target uses agent-only? Fine. The Forward Agent checkbox in Advanced is a separate toggle: enable it on the bastion only if a *third-party* tool on the bastion needs your local agent (e.g. `git push` from the bastion using your laptop's key).
4
Multi-hop (up to 5): A → B → C → target
Need to chain through more than one bastion? Create profile A (no jump), profile B with Jump Chain `[A]`, profile C with Jump Chain `[A, B]` — order matters. The chain editor accepts up to 5 hops. SFTP and tunnels on the final profile work transparently through every hop in the chain.

Frequently asked questions

Can I use a jump host with SFTP and tunnels?+

Yes — SFTP and tunnels work transparently through a jump host. Drag a file to the target host's SFTP pane, the file goes encrypted: Mac → bastion → target. Tunnels work the same way.