Begin with destinations, not client settings
We inventory the destination service, sensitivity, administrative owner, permitted source, authentication method and required protocol. Then we place gateway hosts and forwarding rules around those facts. This prevents a convenient client configuration from quietly becoming the architecture.
What the review covers
- Direct SSH versus gateway-mediated access
- Gateway placement and administrative ownership
- Local, remote and dynamic port forwarding use
- X11-forwarding dependencies
- SFTP browser routing through the gateway
- Source network and endpoint assumptions
- Private-key selection and agent behavior
- DNS, proxy and split-tunnel considerations
- Session naming and environment labels
- Emergency and vendor access exceptions
Decision table
| Question | Evidence | Outcome |
|---|---|---|
| Is direct access necessary? | Network path and destination policy | Direct, gateway or deny |
| Is forwarding permitted? | Service requirement and threat model | Type, port and duration |
| Does X11 need the same gateway? | Application and display test | Documented supported path |
| Who owns an exception? | Business use and approver | Named owner and review date |
Pilot safely
A representative pilot should include a standard administrator, a developer, a high-latency user and at least one restricted destination. We use sanitized test systems where possible and record the exact client, gateway and server conditions behind each result.