Jump Server Icon
A jump server icon shows an entry node in a network diagram. You place this symbol between public networks and private servers. Teams use these drawings to map out how engineers log in to backend systems. Many teams also share one broad SSH role across that entry node. When roles are too broad, one stolen key opens every backend machine. How to place a jump server icon in your diagram Architecture charts need clear shapes so teams can read the login flow fast. Most cloud icon sets do not have
SSH Bastion Hosts / Jump Servers + Kubernetes API Server Access: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
A jump server icon shows an entry node in a network diagram. You place this symbol between public networks and private servers. Teams use these drawings to map out how engineers log in to backend systems. Many teams also share one broad SSH role across that entry node. When roles are too broad, one stolen key opens every backend machine.
How to place a jump server icon in your diagram
Architecture charts need clear shapes so teams can read the login flow fast. Most cloud icon sets do not have one special shape for an entry host. Instead, architects pick a standard server symbol and add a lock or shield badge. You place the jump server icon inside a public subnet box on the chart. Next, you draw solid arrows from user laptops to that public subnet box. Then, you draw dotted arrows from the entry node to private database and app boxes. This layout shows that outside traffic must stop at the entry node first. Good diagrams also label the network ports and user roles next to each arrow. Clear labels help auditors check how engineers reach private systems during a review. Without clear labels, teams guess which SSH keys work on which private machines.
How the native SSH login flow works in practice
A diagram shows the path, but SSH keys control the actual login flow. In a standard setup, an engineer holds a private key on a laptop. The entry node holds the matching public key in a local file. When the engineer logs in, the entry node checks that key pair. Next, the engineer forwards the SSH agent or hops to a private server. The private server checks the network firewall rule and the user role. Many teams group users into broad Linux roles to save setup time. One shared admin role often grants full root rights on every target box. Teams also store static keys on disk for months without rotating them. If an engineer leaves the team, someone must delete that key from every host.
What the native setup solves and what it misses
Using a single entry node solves a major network exposure problem. You do not need to give every private machine a public IP address. Network firewalls only allow SSH traffic from the single entry host IP. This setup shrinks the public surface area that outside attackers can scan. Still, network diagrams and firewall rules only decide who can log in. They do not check what commands an engineer runs inside an active session. Once a user passes the entry check, the native setup allows any shell command. An engineer with a broad role can read raw emails or card numbers. A tired user can also run a bad script that deletes production files. Standard SSH logs show when a login started, not what queries ran inside. To fix this gap, teams must check individual commands and mask sensitive fields in flight.
SSH Bastion Hosts / Jump Servers + Kubernetes API Server Access: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What symbol should I use for a jump server icon?
Use a standard compute instance or server symbol from your cloud icon set. Add a small lock, key, or arrow badge to show it handles remote logins.
Where does the entry node sit in a network diagram?
Place the symbol inside a public or perimeter subnet box near your firewall icon. Draw arrows pointing from that public box into your private app and database subnets.
Why is a network diagram not enough for security audits?
A diagram only shows the planned network path between user laptops and servers. Auditors also need command logs and data masking rules to verify what users actually do.