Bastion hosts
pandastrike.com
Bastion hosts
1–10 of 59 posts
Re: Bastion hosts
#2Bastion host(s) are a useful and important component of a system management infrastructure. A bastion-host, in this context, is actually more properly, but more obscurely, called a jump server. In this post I will simply use the term bastion host. It is the most commonly used term for the system's function: a server, which has undergone security hardening steps, that is the operational and administrative control point for systems and hosts in a datacenter (or AWS Region).
Re: Bastion hosts
#3Direct quote from the page at the other end of this link :
"You appear to be using a browser that may not be able to display our site correctly. Generally, this is beause it's an older browser that doesn't support a lot of the newer, awesome features in open Web standards.
Rather than provide an untested and possibly subpar experience of our site, may we suggest downloading one of these fine browsers? (We think you'll find your overall experience of the Web will improve if you do.)"
This is followed with links for Firefox and Chrome. I am running Firefox 24.4 from CentOS repos. This is unskippable, and there's no simple way to bypass it on the page. On a browser from March of this year.
Urgh.
Re: Bastion hosts
#4Jump boxes are a good idea. A better idea, if you're in AWS, is to use a VPC and just VPN into your environment; the VPN terminator in the VPC serves the same purpose as a jump box.
If OpenVPN scares you, you can still do layer-4 filtering to minimize the impact of losing the OpenVPN server (ie, to get it to "no worse than if we hadn't used VPCs in the first place).
"Single-packet authentication" is, I think, silly, and I've never recommended it to anyone. It's hard to think of a case where hand-rolled authentication in front of SSH has saved anyone with a proper SSH configuration (keys-only-no-passwords). You can skip that step.
Re: Bastion hosts
#5Direct quote from the page at the other end of this link : "You appear to be using a browser that may not be able to display our site correctly. Generally, this is beause it's an older browser that doesn't support a lot of the newer, awesome features in open Web standards. Rather than provide an untested and possibly subpar experience of our site, may we suggest downloading one of these fine browsers? (We think you'l…
Yeah. Welcome to the world of an HTML 'standard' that is 'living'.
Re: Bastion hosts
#6Jumphosts have their uses, but in this case, I really don't see it. As others have pointed out, better yet is VPN only access.
As for the port knocking silliness, well, I don't see any reason for it.
http://bsdly.blogspot.com/2012/04/why-not-use-port-knocking....
Re: Bastion hosts
#7Direct quote from the page at the other end of this link : "You appear to be using a browser that may not be able to display our site correctly. Generally, this is beause it's an older browser that doesn't support a lot of the newer, awesome features in open Web standards. Rather than provide an untested and possibly subpar experience of our site, may we suggest downloading one of these fine browsers? (We think you'l…
Since it's only a plaintext page, you can read it with curl. Or you could, except the server is broken and sends back gzipped data even if the client doesn't request it.
curl https://www.pandastrike.com/posts/20141113-bastion-hosts | gunzip | moreRe: Bastion hosts
#8Direct quote from the page at the other end of this link : "You appear to be using a browser that may not be able to display our site correctly. Generally, this is beause it's an older browser that doesn't support a lot of the newer, awesome features in open Web standards. Rather than provide an untested and possibly subpar experience of our site, may we suggest downloading one of these fine browsers? (We think you'l…
[deleted]
Re: Bastion hosts
#9Jump boxes are a good idea. A better idea, if you're in AWS, is to use a VPC and just VPN into your environment; the VPN terminator in the VPC serves the same purpose as a jump box. If OpenVPN scares you, you can still do layer-4 filtering to minimize the impact of losing the OpenVPN server (ie, to get it to "no worse than if we hadn't used VPCs in the first place). "Single-packet authentication" is, I think, silly,…
Do you have a good reference to administering an OpenVPN server? Setting it up is easy, setting it up with HA is also no problem, but administrating OpenVPN for a startup that doesn't have a dedicated sysadmin would be a very useful guide.
Re: Bastion hosts
#10Jump boxes are a good idea. A better idea, if you're in AWS, is to use a VPC and just VPN into your environment; the VPN terminator in the VPC serves the same purpose as a jump box. If OpenVPN scares you, you can still do layer-4 filtering to minimize the impact of losing the OpenVPN server (ie, to get it to "no worse than if we hadn't used VPCs in the first place). "Single-packet authentication" is, I think, silly,…
> A better idea, if you're in AWS, is to use a VPC and just VPN into your environment;
Is it though? Is having your (and your co-workers) desktops/laptops/and possibly more directly able to access production servers at a packet level a good idea?
I would posit that it is not. A bastion host can be used to lock down more than firewalls, and reduces the attack surface living on your network considerably.
> VPN terminator in the VPC serves the same purpose as a jump box.
It certainly serves the same network separation purposes a jump box does, but is not able to dictate the access environment nearly as much. If only your jump box has access to servers (and production servers properly filtered), every bit of remote access must go through that single ingress/egress point. And that point can have security policy built-in as well for multi-person teams. For example: I can enforce certain key types being utilized on remote hosts, logging of ssh sessions, etc.
I also agree the "single packet authentication" is silly though. Most bastion hosts these days will be behind VPN already. Just another riff on port knocking really.