SSH Bastion Hardening: Securing Your Gateway

In today's digital landscape, security is paramount. One of the most crucial aspects of securing a network is building a secure bastion host. A bastion host is a special purpose computer on a network specifically designed and configured to withstand attacks. In this article, we will explore how Telenor Digital implemented an SSH bastion hardening solution using Ubuntu.

At Telenor Digital, we have about 20 federated AWS accounts, and securing our connections has been a top priority. We wanted to avoid setting up a complex system of VPNs and instead opted for a more streamlined approach. Our technology stack uses Ubuntu exclusively, so it made sense to base our bastion on a minimal Ubuntu install.

Our goal was to create a secure bastion that would allow authorized users to SSH into the bastion and then connect to other instances via SSH forwarding. We also wanted to be able to connect to any account from anywhere, not just designated IP ranges. This would massively reduce our attack surface, but we had to ensure that the server exposed to the internet was as secure as possible.

To achieve this, we stripped out unnecessary packages and added extra security measures to our Ubuntu install. We also used Consul, Ansible, and Filebeat services, which are already part of our technology stack. Our preferred forwarding solution is sshuttle, a transparent proxy server also known as a 'poor man's VPN.'

The process was not without its challenges. We found that there was limited information available on how to implement a secure bastion host, particularly in the cloud. Amazon AWS did not have a designated bastion host instance type available at the time of writing.

In conclusion, building a secure bastion host is no easy task, but with the right approach and technology stack, it can be done. Our experience with Ubuntu has been invaluable in this process, and we are confident that our SSH bastion hardening solution will provide a robust and secure gateway for our AWS accounts.

Ssh bastion hardening