Google IAP and AWS Session Manager are hosted solutions that tunnel SSH traffic to your internal cloud network. All of your clients will also need to run Wireguard or Nebula. You could run one of these at the edge of your internal network (like a VPN), or on all the hosts you want to be able to access, and tunnel SSH traffic through it. The most common open source options for this are Wireguard and Nebula. Set up an overlay networkĪn overlay network is a lighter and simpler kind of VPN that supports roaming endpoints. If you need deeper access to your internal network than you can get with SSH or RDP, you may want a VPN.īut IPsec VPNs add a lot of complexity and maintenance burden compared to the other options, including bastion hosts. Alternatives to bastions Set up an IPsec VPN Here are some alternatives you might consider. If you have an internal network and you need to reach those hosts from the public internet, a bastion host is an easy option.ĭo you even need a bastion? As with nearly any decision in technology, it depends. Then we'll talk about some fancier stuff we could do. We're going to keep things simple here and build a bastion from scratch that supports the proxying of SSH connections. Given its position, it can take on a lot of responsibilities: auditing and session logging, user authentication for internal hosts, and advanced threat detection.

Bastion hosts often run OpenSSH or a remote desktop server.Ī bastion host serves as an important choke point in a network. In the same way that a home WiFi router sits between the vast and perilous internet and the often insecure devices on a local network, a bastion host sits between the public internet and an internal network (a VPC, for example), acting as a gateway to reach the internal hosts while protecting them from direct exposure to the wilds of the public internet.

What's a bastion host?īastion is a military term meaning 'a projecting part of a fortification.' Let's build and configure a minimal SSH bastion host (jump box) from scratch, using Ubuntu 20.04 LTS.

Rdp into aws bastion host password