Home / server / Questions / 1046060
In Process
Joel Divekar
Asked: 2020-12-14 23:02:05 +0800 CST

Bastion host user access

  • 772

I am using my bastion host to connect to internal servers as follows

ssh -J user@BastionHost user@InternalServer

Is it required to create user on Bastion host to jump to internal servers ? Or can we just use this server to Jump to internal servers ?

ssh bastion

1 Answers

  1. The purpose of the bastion host is, among others, to allow only authenticated users to access to your internal servers.

    How your bastion does that authentication is something you can decide on.

    Creating a user account there for each user that is allowed remote ssh access is an easy way to set up such authentication.

    That comes with a couple of advantages (quite robust, easy to understand etc) but depending on the number of joiners and leavers maybe laborious to maintain and scale. And when you only provide ssh access people will need to tunnel other protocols (for instance to manage your databases)

    Running a VPN server on your bastion host allows for more flexibility. A VPN also has the advantage that VPN users won’t be able to access the bastion server itself, it only provides access to the internal servers.

    • 0