This looks like a less trustworthy version of Apache Guacamole.
JumpServer: Open-Source Privileged Access Management
11–20 of 36 posts
Re: JumpServer: Open-Source Privileged Access Management
#12I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind "we use fail2ban to protect us" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t…
At one of the top tier 1 ISPs in the world, there was a bastion host that allowed 2 teams of network engineers unfettered access to everything; once your permissions allowed you access to the bastion, you had everything. 50 some people with trivial credentialed access to network infrastructure that the world ran on; fatfinger a bgp config and you could take down countries. Swathes of cities were regular casualities o…
Sounds like the 90’s early ISP experience scaled up. No firewalls, everything on public IPs, text files with global credentials in clear text…
Re: JumpServer: Open-Source Privileged Access Management
#13What am I looking at? I'm not really sure, is it some sort of Citrix replacement? I tried to look at the documentation but was left with more questions, the "free" version mentions "Linux server" (not even the GNU utilities?) and is just available as a curl | bash (but the apparently targets RHEL, Suse, Debian/Ubuntu and Alpine) and I started to glance through the git "mysqldump -uroot -h127.0.0.1 -p jumpserver -P330…
More like a replacement for something like CyberArk than for Citrix.
It's not so much about the remote access as it is about control and auditing.
i.e. ability to permit/deny certain commands/behaviours, and a complete audit log of the session, sometimes extending to a screen recording of an rdp session.
Re: JumpServer: Open-Source Privileged Access Management
#14I used Bastion before. I'd not be too happy using an interpeted language like Python (that has eval capabilities) for this kind of purpose.
We used it a lot at first, but as our setup got more mature we rarely needed to SSH to our application servers/containers.
In my current project, I did not even setup smth like this.
Re: JumpServer: Open-Source Privileged Access Management
#15Earlier quoted context omitted.
At one of the top tier 1 ISPs in the world, there was a bastion host that allowed 2 teams of network engineers unfettered access to everything; once your permissions allowed you access to the bastion, you had everything. 50 some people with trivial credentialed access to network infrastructure that the world ran on; fatfinger a bgp config and you could take down countries. Swathes of cities were regular casualities o…
Sounds like the 90’s early ISP experience scaled up. No firewalls, everything on public IPs, text files with global credentials in clear text…
I have been transported back to the days of `conf t`, `enable password hunter2`, `show run`, `copy run start`
Re: JumpServer: Open-Source Privileged Access Management
#16What am I looking at? I'm not really sure, is it some sort of Citrix replacement? I tried to look at the documentation but was left with more questions, the "free" version mentions "Linux server" (not even the GNU utilities?) and is just available as a curl | bash (but the apparently targets RHEL, Suse, Debian/Ubuntu and Alpine) and I started to glance through the git "mysqldump -uroot -h127.0.0.1 -p jumpserver -P330…
At first glance, it looks like a parallel-universe Linux version of JumpCloud.
Re: JumpServer: Open-Source Privileged Access Management
#17Aside concerns that this is not mature and may possible be built using AI-driven development. Does this not just put every resource behind a single point of failure?
Re: JumpServer: Open-Source Privileged Access Management
#18I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind "we use fail2ban to protect us" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t…
Seriously "let's just put every single person thru one server unencrypted" is IDEAL place to attack.
At least in case of VPN you only tunnel then-encrypted (in most cases) traffic to servers - so at worst case you at least have protection of ssh/https
Re: JumpServer: Open-Source Privileged Access Management
#19I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind "we use fail2ban to protect us" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t…
Did most of the companies have external facing jump servers? I'd hope at least companies have internal-only and even then with strict internal network access policies (+VPN etc) and ldap authorization etc. Can't imagine that any competent orgs would have externally-facing ssh or windows bastion hosts.
Re: JumpServer: Open-Source Privileged Access Management
#20What am I looking at? I'm not really sure, is it some sort of Citrix replacement? I tried to look at the documentation but was left with more questions, the "free" version mentions "Linux server" (not even the GNU utilities?) and is just available as a curl | bash (but the apparently targets RHEL, Suse, Debian/Ubuntu and Alpine) and I started to glance through the git "mysqldump -uroot -h127.0.0.1 -p jumpserver -P330…
At first glance, it looks like a parallel-universe Linux version of JumpCloud.
that association probably stings a bit
https://www.bleepingcomputer.com/news/security/jumpcloud-bre...
(side note: always say the attackers were from North Korea.)