# The Bastion host: How to set up and benefits of using it.

DevFeed: [The Bastion host: How to set up and benefits of using it.](<https://devfeed.tech/articles/the-bastion-host-how-to-set-up-and-benefits-of-using-it-19771.md>)

Original publisher: [Read original article](<https://cloud.blog.csc.fi/2019/07/the-bastion-host-how-to-set-up-and.html>)

Author: Unknown (noreply@blogger.com)

Published: 2019-07-03T07:24:00Z

Content type: tutorial

Language: en

Sources: [CSC - IT Center For Science - Cloud Team](<https://devfeed.tech/sources/csc-it-center-for-science-cloud-team.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>), [Ansible](<https://devfeed.tech/topics/ansible.md>), [Network](<https://devfeed.tech/topics/network.md>), [servers](<https://devfeed.tech/topics/servers.md>)

Tags: [ansible](<https://devfeed.tech/tags/ansible.md>), [bastion](<https://devfeed.tech/tags/bastion.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [network](<https://devfeed.tech/tags/network.md>), [remote](<https://devfeed.tech/tags/remote.md>), [security](<https://devfeed.tech/tags/security.md>), [servers](<https://devfeed.tech/tags/servers.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [user-guide](<https://devfeed.tech/tags/user-guide.md>)

## AI overview

This tutorial explains bastion hosts as intermediary jump hosts for connecting to internal servers. It describes how they reduce exposure by keeping internal services off the internet and outlines setup using users, SSH ProxyCommand, an SSH configuration file, and Ansible playbooks.

## Source excerpt

What is a bastion host Bastion host just works like a jumphost, through which, we can connect to other servers. It can be used as an entry point to connect to internal servers which increases security as well. The following diagram can be useful to understand how we can connect to our internal hosts through a bastion host. The benefit of using bastion hosts One advantage using a bastion is the ability to use services which do not need to be directly accessible from internet, as in do not require a floating IP for each individual server. Most admin traffic and some user traffic can be tunnelled through the bastion host. The second and more important advantage is that by not having a floating IP the attack surface is reduced. A common mistake is that users are running inherently insecure services like network files system, databases, remote desktops a.s.o. and by mistake makes these services available to the internet. By not giving floating IPs to instances that run internal service you are eliminating one attack vector and also implement good practice of using layered security https://simple.wikipedia.org/wiki/Defense_in_depth_(computing). A bastion host itself has quite a small attack vector, for example in our example linked below we would only allow for incoming ssh traffic. How to create a bastion host We can make one host as our bastion host. To do so, we need to set up users in bastion host so that through bastion host, same users can pass through and log in to other internal servers and do administrative tasks. After setting up users in the bastion host, we can use proxycommand option of ssh to connect to other servers behind the bastion host. We also need a predefined ssh.config file. We can use ansible to make a host into a bastion host. Bastion git repo has some playbooks and an example ssh.config file. How to connect a host through a bastion host After we have set up our users in bastion host we can connect to our internal servers through a bastion host by