Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JumpServer: Open-Source Privileged Access Management

github.com

Post reply on HN
Print view View original

31–36 of 36 posts

Re: JumpServer: Open-Source Privileged Access Management

#31

Post by jasongill »

indigodaddy wrote: post #19
jasongill wrote: post #5

I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind "we use fail2ban to protect us" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t…

Did most of the companies have external facing jump servers? I'd hope at least companies have internal-only and even then with strict internal network access policies (+VPN etc) and ldap authorization etc. Can't imagine that any competent orgs would have externally-facing ssh or windows bastion hosts.

> Can't imagine that any competent orgs would have externally-facing ssh or windows bastion hosts.

I have seen shit that would turn you white.

Re: JumpServer: Open-Source Privileged Access Management

#32

Post by nextaccountic »

observationist wrote: post #6
jasongill wrote: post #5

I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind "we use fail2ban to protect us" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t…

At one of the top tier 1 ISPs in the world, there was a bastion host that allowed 2 teams of network engineers unfettered access to everything; once your permissions allowed you access to the bastion, you had everything. 50 some people with trivial credentialed access to network infrastructure that the world ran on; fatfinger a bgp config and you could take down countries. Swathes of cities were regular casualities o…

> That experience shattered my idea that the world was being operated by competent engineers and technicians, governed by sane policies, under the watchful care of good, knowledgable people.

Reminds me the amount of debt that exists only as an entry in an excel spreadsheets somewhere. No database with high availability and regular backups and audit logs and access control and all of that, just a spreadsheet.

Re: JumpServer: Open-Source Privileged Access Management

#33

Post by j45 »

jasongill wrote: post #5

I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind "we use fail2ban to protect us" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t…

This is a nice summary of bastion boxes when they're at the edge of your capability, or worse, you stop learning about securing your environment moving forward.

For the OP/others, it would be great if folks can share what they do to secure their environments, with or without a jump box.

Re: JumpServer: Open-Source Privileged Access Management

#34

Post by johntash »

jasongill wrote: post #5

I've been in the industry for a long, long time, and I would say that use of bastion hosts ranks #2 on my list of things that tell me your environment is not secure (right behind "we use fail2ban to protect us" as the #1 clue). I've bought a bunch of companies and seriously evaluated hundreds of them, and the ones where people had a bastion host set up commonly seemed to act as if it protected them from everything, t…

Would you see using a vpn as the better alternative to a bastion host?

I've worked at a couple places where prod is air-gapped except for the bastion host that allows access to prod. But the bastion itself is still behind a vpn. And of course each user still has separate user accounts on both the bastion box and prod boxes.

I can definitely see your point though that a bastion/jumpbox isn't enough by itself.

Re: JumpServer: Open-Source Privileged Access Management

#36

Post by bzmrgonz »

flossly wrote: post #14

I used Bastion before. I'd not be too happy using an interpeted language like Python (that has eval capabilities) for this kind of purpose. We used it a lot at first, but as our setup got more mature we rarely needed to SSH to our application servers/containers. In my current project, I did not even setup smth like this.

Go on, tell us what you setup. I'm looking at zed multi-user as a possible alternative to this.
Post reply on HN