Bastion hosts

All of this is great, but why would you need this if you're managing servers? Especially servers you control...

Consider your environment.

In the office, you might have access to every machine the company has under its dominion, because you're sat on a LAN segment that has unfettered access to every other network segment.

Remotely, you might have a VPN machine on the border of your network, to which you need to initially establish a connection before you're able to SSH to other machines.

Bastion hosts are something you might consider, and they can be used in conjunction with a VPN.

You, as the system administrator, can decide that you'd like a single point of ingress for people SSH'ing to machines to easily log traffic and maybe manage keys – perhaps because you're just vindictive and want everyone's config file to be that much longer?

Work with your network team, consult your company's policies, and design a network that you can easily maintain, and that others won't mind using.