Use Bastion Hosts for Secure Server Access

A Bastion Host is a hardened server that acts as a secure gateway for accessing other internal or production servers. This reduces the attack surface by centralizing access control and monitoring.

✅ Adds an extra security layer between users and production servers.
✅ Prevents direct SSH access to critical infrastructure.
✅ Enables detailed logging and access auditing for security monitoring.
✅ Supports Multi-Factor Authentication (MFA) for enhanced security.

By using a bastion host, you enforce strong access control policies and limit attack exposure.

How to Set Up a Secure Bastion Host

1. Deploy a Dedicated Bastion Host

1. Create a separate virtual or physical server in a DMZ (Demilitarized Zone) or public subnet.

2. Use a minimal OS install (e.g., Ubuntu Server, CentOS, or Amazon Linux) to reduce attack vectors.

3. Apply strict firewall rules to allow only SSH access from trusted IPs.

For Ubuntu/Debian, install OpenSSH Server if not installed:

sudo apt update && sudo apt install openssh-server -y

For CentOS/RHEL:

sudo yum install openssh-server -y

2. Restrict Direct SSH Access to Production Servers

• Deny direct SSH access to critical servers.

• Only allow SSH traffic via the bastion host.

Modify SSH Config on Production Servers to Allow Only Bastion Access

On each production server, edit the SSH configuration:

sudo nano /etc/ssh/sshd_config

Add:

AllowUsers bastion-user@bastion-ip
PermitRootLogin no
PasswordAuthentication no

Restart SSH to apply changes:

sudo systemctl restart sshd

Enforce SSH Access via the Bastion Host

1. On client machines, first connect to the bastion:

   ssh -J bastion-user@bastion-ip user@production-server-ip
   

2. Or, configure SSH ProxyJump in ~/.ssh/config:

   Host production-server
       HostName production-server-ip
       User user
       ProxyJump bastion-user@bastion-ip
   

   Now, simply run:

   ssh production-server
   

   (This automatically routes through the bastion host.)

3. Enforce Multi-Factor Authentication (MFA) on the Bastion Host

To add an extra layer of security, configure MFA for SSH logins on the bastion.

Install Google Authenticator for 2FA

sudo apt install libpam-google-authenticator -y
google-authenticator

Follow the prompts and save the secret key or QR code.

Enable MFA in PAM Authentication

Edit the PAM SSH configuration file:

sudo nano /etc/pam.d/sshd

Add:

auth required pam_google_authenticator.so

Require MFA for SSH Logins

Edit the SSH configuration:

sudo nano /etc/ssh/sshd_config

Ensure:

ChallengeResponseAuthentication yes
UsePAM yes

Restart SSH:

sudo systemctl restart sshd

Now, users must enter a verification code from Google Authenticator before accessing the bastion.

4. Enable Logging and Session Auditing

A bastion host should log all SSH sessions for monitoring and forensic analysis.

Enable Session Logging with Auditd

1. Install Auditd:

   sudo apt install auditd -y
   

2. Configure Auditd to monitor SSH sessions:

   sudo nano /etc/audit/rules.d/audit.rules
   

   Add:

   -w /var/log/auth.log -p wa -k ssh_access
   -w /etc/ssh/sshd_config -p wa -k ssh_config_changes
   

3. Restart Auditd:

   sudo systemctl restart auditd
   

Record SSH Sessions with Tlog

1. Install Tlog:

   sudo apt install tlog -y
   

2. Configure Tlog to record SSH sessions in /var/log/tlog/.

5. Implement Firewall Rules to Restrict SSH Access

Use UFW (Uncomplicated Firewall) to limit SSH access only to trusted IPs.

On the Bastion Host

sudo ufw allow from your-trusted-ip to any port 22 proto tcp
sudo ufw enable

On Production Servers

sudo ufw allow from bastion-ip to any port 22 proto tcp

(Only allows SSH traffic from the bastion host.)

6. Automate and Enforce Security Policies

• Use Ansible or Terraform to automate bastion setup.

• Apply SSH hardening guidelines (sudo nano /etc/ssh/sshd_config).

• Monitor SSH login attempts (sudo cat /var/log/auth.log | grep sshd).

Best Practices for Bastion Host Security

✅ Ensure bastion hosts are separate from production servers.
✅ Use SSH key authentication instead of passwords.
✅ Rotate SSH keys and enforce MFA for privileged users.
✅ Monitor SSH access logs for anomalies and failed login attempts.
✅ Regularly update the bastion host OS and security patches.

By implementing a bastion host, you create a controlled and monitored access point for your Linux production servers, significantly enhancing security and access management.