BASTION SERVER AWS HOW TO

# Allow ec2-user only to access this folder and its content Note that I intentionally block a few SSH features because they would allow users to create a direct connection between their local computer and the Linux instances, thereby bypassing the solution. See the step-by-step example in the “Testing the solution” section later in this blog post. You can replay the session from the resulting log files by using the scriptreplay command. By doing so, the script command records everything displayed on the terminal, including keyboard input and full-screen applications such as vim. Instead, I configure OpenSSH to execute a custom script that wraps an interactive shell into a script command. When a client connects to an Amazon Linux instance, the default behavior of OpenSSH, the SSH server, is to run an interactive shell. I do not discuss hardening in detail in this blog post. Hardening might include disabling unnecessary applications or services, tuning the network stack, and the like.

Note: It is a best practice to harden your bastion host because it is a critical point of network security. You configure the solution by running commands at launch as the root user on an Amazon Linux instance. This blog post’s solution for recording SSH sessions resides on the bastion host only and requires no specific configuration of Linux instances. What matters is that the bastion host remains the only source of SSH traffic to your Linux instances. For example, you could have the bastion host in a separate Amazon VPC and a VPC peering connection between the two Amazon VPCs. You can adapt this architecture to meet your own requirements. Bastion host users connect to the bastion host to connect to the Linux instances, as illustrated in the following diagram. Linux instances are in a subnet that is not publicly accessible, and they are set up with a security group that allows SSH access from the security group attached to the underlying EC2 instance running the bastion host. The bastion host runs on an Amazon EC2 instance that is typically in a public subnet of your Amazon VPC.

BASTION SERVER AWS HOW TO

Later in this post, I provide instructions about how to implement and test the solution.Īmazon VPC enables you to launch AWS resources on a virtual private network that you have defined. In this section, I present the architecture of this solution and explain how you can configure the bastion host to record SSH sessions. Recording SSH sessions enables auditing and can help in your efforts to comply with regulatory requirements. In this blog post, I will show you how to leverage a bastion host to record all SSH sessions established with Linux instances.

For example, you can use a bastion host to mitigate the risk of allowing SSH connections from an external network to the Linux instances launched in a private subnet of your Amazon Virtual Private Cloud (VPC). Because of its exposure to potential attack, a bastion host must minimize the chances of penetration. A bastion host is a server whose purpose is to provide access to a private network from an external network, such as the Internet.

Bastion server aws