Use jump hosts without spreading keys

The client authenticates to the bastion and then to the private server using local identities and host verification for both. This is a small part of a safe operator path from a local machine to a disposable Ubuntu server, including file transfer, tunnels, automation, and recovery, but the boundary it creates affects everything that follows.

ProxyJump forwards the connection path through an intermediate host without requiring a private key to live on that host. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to copy private keys to the bastion or enable agent forwarding by habit. It makes later failures harder to locate. Instead, configure ProxyJump, verify every host key separately, and use agent forwarding only after reviewing bastion risk. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Use SSH as a controlled transport for commands, files, and connections while understanding each new exposure. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

Connect to a private disposable host through a bastion and show where each key operation occurs. Hand the result to someone else and see whether the behavior is clear without an oral explanation.