#Autibon ssh bastion how to#

Capture and send all logs to centralized logging infrastructure.ĥ. Create security groups and network ACLs to control access to the bastion (public internet) and servers with a VPC (can only be accessed via bastion)Ĥ. Don't allow or limit interactive sessions on the bastion server (use `ProxyJump instead).ģ. Use CIS or STIG hardening guides.Įnable automatic upgrades. In general, at the minimum, you'll have to do the following.ġ. SSH Best Practices using Certificates, 2FA and Bastions

#Autibon ssh bastion how to#

The internet is full of guides on how to do this - we've listed a few below. Running OpenSSH on an EC2 instance is the classic way to build a bastion server on AWS. Below is a list of the most popular ways. There are many ways to set up SSH bastion servers on AWS. Different options for SSH bastion servers on AWS You can enforce centralized audit logging to track who logged into a server and what they did on a server. You can enforce centralized SSH key management (grant, revoke, and rotate keys). Bastion hosts are single-purpose machines and you can dramatically reduce what runs on them. Your SSH servers (other than the bastion itself) no longer need to be Once you start thinking about bastions from that perspective, bastions become an important part of your efforts to reduce and mitigate attacks on your infrastructure. A better option would be to build a strong wall around them with a few gates where you can focus your hardening efforts and control access to your entire city. You can secure every single building in your city, but that will be costly and there is a good chance you'll forget about one of them. Think of your EC2 instances as buildings within a medieval city. However, this will create more work for you and likely reduce your security posture. You can perform Linux hardening on every EC2 instance you have and tie them into security primitives that AWS provides to avoid bastion servers completely. Strictly speaking, you don't need a SSH bastion server. Why do you need a SSH bastion on AWS at all? Management and access to your compute infrastructure. Once you have a few AWS EC2 instances, it's time to start thinking about setting up an EC2 instance as an SSH bastion server so you can centralize and secure