# bastion Published articles for bastion. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Secure Amazon EKS Access with Teleport. DevFeed: [Secure Amazon EKS Access with Teleport.]() Original publisher: [Read original article]() Author: info@goteleport.com (Janakiram MSV) Published: 2022-07-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon EKS](), [Kubernetes](), [Security](), [Amazon EC2]() Tags: [amazon-eks](), [bastion](), [kubernetes](), [security]() ### AI overview This tutorial explains how to secure access to Amazon EKS clusters with Teleport. It covers configuring a Teleport proxy/auth server, staging and production EKS clusters, and a Teleport Kubernetes agent in each cluster. ### Source excerpt Learn how to secure Amazon EKS access with Teleport. ## Securing Your MongoDB Database DevFeed: [Securing Your MongoDB Database]() Original publisher: [Read original article]() Author: info@goteleport.com (Kainaat Arshad) Published: 2022-05-24T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [MongoDB](), [Security](), [Firewall](), [Self-hosted](), [ssh](), [SSL](), [Windows]() Tags: [bastion](), [bastion-host](), [best-practices](), [database](), [firewall](), [hardening](), [how-to](), [linux](), [mongodb](), [network-security](), [security](), [self-hosted](), [ssh](), [ssl](), [tls](), [windows]() ### AI overview A tutorial on securing MongoDB deployments, covering self-hosted MongoDB and MongoDB Atlas. It discusses network security, TLS/SSL transport encryption, database privileges, firewalls, and SSH reverse tunneling through a bastion host. ### Source excerpt How to secure your MongoDB database for both self-hosted and MongoDB Atlas deployments. ## How to Audit SSH Sessions in Amazon EC2 DevFeed: [How to Audit SSH Sessions in Amazon EC2]() Original publisher: [Read original article]() Author: info@goteleport.com (Janakiram MSV) Published: 2022-04-19T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Amazon EC2](), [ssh](), [Tutorial](), [audit](), [Security](), [Amazon S3](), [DynamoDB](), [OpenSSH]() Tags: [amazon-cloudwatch](), [amazon-dynamodb](), [amazon-s3](), [audit](), [aws](), [bastion](), [bastion-host](), [cloudtrail](), [compliance](), [dynamodb](), [ec2](), [how-to](), [infrastructure](), [review](), [s3](), [security](), [security-events](), [ssh](), [storage](), [tutorial]() ### AI overview A tutorial on configuring Teleport to record and audit SSH sessions on Amazon EC2 Linux instances, including centralized session playback and storing Teleport events and recordings in Amazon DynamoDB and Amazon S3. ### Source excerpt This post is a tutorial to set up security session recording for EC2 SSH access and store logs in AWS S3 and DynamoDB. ## SSH Security Best Practices using Certificates, 2FA and Bastions DevFeed: [SSH Security Best Practices using Certificates, 2FA and Bastions]() Original publisher: [Read original article]() Author: info@goteleport.com (Gus Luxton) Published: 2022-04-11T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [ssh](), [Security](), [OpenSSH](), [certificates](), [Authentication](), [MFA]() Tags: [authentication](), [bastion](), [certificates](), [openssh](), [passwords](), [security](), [security-best-practices](), [server](), [ssh]() ### AI overview This tutorial explains SSH security best practices, focusing on certificates, two-factor authentication, and bastion hosts. It provides sample commands and configurations for implementing these practices with OpenSSH. ### Source excerpt This post explains security best practices to use SSH properly and securely ## What is an SSH Bastion? | SSH Bastion host setup DevFeed: [What is an SSH Bastion? | SSH Bastion host setup]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2022-04-04T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [ssh](), [OpenSSH](), [configuration](), [Linux](), [Security](), [Open Source]() Tags: [bastion](), [bastion-host](), [configuration](), [how-to](), [installation](), [linux](), [open-source](), [openssh](), [security](), [server](), [ssh]() ### AI overview This tutorial explains what an SSH bastion host is and how it differs from an SSH jump server or proxy. It covers setting up bastions with OpenSSH and another open-source SSH server, along with Linux hardening, firewall configuration, port changes, updates, and limiting the bastion to jump access. ### Source excerpt In this blog post, we'll go over the installation and configuration of SSH bastion hosts using two open source products. ## Tutorial: Set up an Identity-Aware Access Proxy as a Bastion Host in AWS DevFeed: [Tutorial: Set up an Identity-Aware Access Proxy as a Bastion Host in AWS]() Original publisher: [Read original article]() Author: info@goteleport.com (Janakiram MSV) Published: 2022-03-10T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Tutorial](), [Amazon Web Services](), [Zero Trust](), [Security](), [Amazon EC2](), [VPC](), [Amazon Elastic Kubernetes Service](), [Amazon RDS](), [DevOps](), [Open Source]() Tags: [amazon-ec2](), [amazon-eks](), [amazon-rds](), [amazon-web-services](), [authentication](), [aws](), [bastion](), [bastion-host](), [best-practices](), [devops](), [how-to](), [let](), [oidc](), [saml](), [security](), [tutorial](), [vpc]() ### AI overview This tutorial explains how to use Teleport, an open-source identity-aware access proxy, as a bastion host for securing AWS infrastructure. It focuses on replacing a traditional bastion host with a Teleport proxy and authentication server for SSH access to EC2 instances, while also describing access to services such as RDS and EKS. ### Source excerpt This post explains how to set-up AWS bastion host based on Teleport identity-aware access proxy. ## SSH ProxyJump and ProxyCommand: How to Use Jump Hosts (2026) | Teleport DevFeed: [SSH ProxyJump and ProxyCommand: How to Use Jump Hosts (2026) | Teleport]() Original publisher: [Read original article]() Author: info@goteleport.com (Zephyr Iglesias) Published: 2022-03-01T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [ssh](), [OpenSSH](), [gateway](), [configuration]() Tags: [bastion](), [command-line](), [config](), [configuration](), [how-to](), [jump-host](), [openssh](), [proxycommand](), [ssh]() ### AI overview A tutorial on using SSH ProxyJump and the older ProxyCommand approach to reach private hosts through one or more jump hosts. It covers command-line usage, SSH configuration, multi-hop connections, and the limitations of managing bastions at scale. ### Source excerpt Use SSH ProxyJump and ProxyCommand to reach private hosts through a jump host. Copy-paste config for single and multi-hop jumps, plus what replaces bastions at scale. ## 14 Best Practices to Secure SSH Bastion Host DevFeed: [14 Best Practices to Secure SSH Bastion Host]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-01-13T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Security](), [OpenSSH](), [ssh](), [Server](), [Network Configuration](), [zero trust networking](), [Ubuntu](), [Amazon Web Services]() Tags: [bastion](), [bastion-host](), [best-practices](), [configuration](), [deployment](), [hardening](), [high-availability](), [infrastructure](), [linux](), [lts](), [network](), [network-configuration](), [networking](), [openssh](), [operations](), [security](), [server](), [ssh](), [ubuntu](), [zero-trust-networking]() ### AI overview This tutorial presents 14 best practices for building and deploying a security-hardened SSH bastion host using OpenSSH. It covers reducing the server attack surface, configuring the surrounding network, applying zero trust networking principles, hardening the operating system and authentication, and deploying for high availability. ### Source excerpt Learn 14 best practices to build and deploy a security-hardened SSH bastion host based on OpenSSH server. ## Why Bastions Still Matter for Secure Remote Access to Cloud Infrastructure DevFeed: [Why Bastions Still Matter for Secure Remote Access to Cloud Infrastructure]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2021-09-22T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [cloud-infrastructure](), [remote access](), [Security](), [networking](), [OpenSSH](), [Firewall]() Tags: [bastion](), [cloud](), [firewall](), [networking](), [openssh](), [remote-access](), [security]() ### AI overview The article argues that bastions remain a recommended solution for managing secure remote access to cloud infrastructure, despite shifts toward identity-, data-, and compute-based security perimeters and software-defined networking. ### Source excerpt Cloud, serverless, immutable infrastructure, Kubernetes - Where do bastions fit in these scenarios? Do we even need one? ## The Bastion host: How to set up and benefits of using it. DevFeed: [The Bastion host: How to set up and benefits of using it.]() Original publisher: [Read original article]() Author: Unknown (noreply@blogger.com) Published: 2019-07-03T07:24:00Z Content type: tutorial Language: en Sources: [CSC - IT Center For Science - Cloud Team]() Topics: [Security](), [ssh](), [OpenSSH](), [Ansible](), [Network](), [servers]() Tags: [ansible](), [bastion](), [how-to](), [network](), [remote](), [security](), [servers](), [ssh](), [user-guide]() ### AI overview This tutorial explains bastion hosts as intermediary jump hosts for connecting to internal servers. It describes how they reduce exposure by keeping internal services off the internet and outlines setup using users, SSH ProxyCommand, an SSH configuration file, and Ansible playbooks. ### Source excerpt What is a bastion host Bastion host just works like a jumphost, through which, we can connect to other servers. It can be used as an entry point to connect to internal servers which increases security as well. The following diagram can be useful to understand how we can connect to our internal hosts through a bastion host. The benefit of using bastion hosts One advantage using a bastion is the ability to use services which do not need to be directly accessible from internet, as in do not require a floating IP for each individual server. Most admin traffic and some user traffic can be tunnelled through the bastion host. The second and more important advantage is that by not having a floating IP the attack surface is reduced. A common mistake is that users are running inherently insecure services like network files system, databases, remote desktops a.s.o. and by mistake makes these services available to the internet. By not giving floating IPs to instances that run internal service you are eliminating one attack vector and also implement good practice of using layered security https://simple.wikipedia.org/wiki/Defense_in_depth_(computing). A bastion host itself has quite a small attack vector, for example in our example linked below we would only allow for incoming ssh traffic. How to create a bastion host We can make one host as our bastion host. To do so, we need to set up users in bastion host so that through bastion host, same users can pass through and log in to other internal servers and do administrative tasks. After setting up users in the bastion host, we can use proxycommand option of ssh to connect to other servers behind the bastion host. We also need a predefined ssh.config file. We can use ansible to make a host into a bastion host. Bastion git repo has some playbooks and an example ssh.config file. How to connect a host through a bastion host After we have set up our users in bastion host we can connect to our internal servers through a bastion host by ## SSH Kubernetes bastion for AWS EKS DevFeed: [SSH Kubernetes bastion for AWS EKS]() Original publisher: [Read original article]() Author: ev@goteleport.com (Ev Kontsevoy) Published: 2019-04-01T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Amazon EKS](), [Kubernetes](), [Amazon Web Services](), [gateway](), [Authentication]() Tags: [access-control](), [audit](), [authentication](), [aws](), [bastion](), [certificates](), [cli](), [gateway](), [github](), [kubernetes](), [kubernetes-clusters](), [release](), [ssh](), [sso]() ### AI overview Teleport 3.2 adds support for Amazon EKS by switching from the unsupported CSR API to the Kubernetes Impersonation API. This lets Teleport serve as an authentication gateway for EKS clusters and support more fine-grained RBAC. ### Source excerpt This new release of Teleport brings support for EKS. Now Teleport can act as a single authentication gateway for Kubernetes clusters running on EKS ## How to use Let's Encrypt with an SSH Bastion DevFeed: [How to use Let's Encrypt with an SSH Bastion]() Original publisher: [Read original article]() Author: info@goteleport.com (Russell Jones) Published: 2018-02-05T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [certificates](), [Web](), [Security](), [HTTP](), [Server]() Tags: [bastion](), [certificates](), [command-line](), [configuration](), [debian](), [how-to](), [https](), [let-s-encrypt](), [port](), [private-key](), [proxy](), [ssh](), [tutorials](), [ui](), [web](), [x509]() ### AI overview A tutorial on configuring the Teleport SSH proxy, also called a bastion, to use an x509 certificate issued and renewed by Let's Encrypt for HTTPS access. ### Source excerpt The Teleport Proxy requires a valid x509 certificate to serve the Web UI via HTTPS. This post shows how to configure the Teleport Proxy to use Let's Encrypt. ## Teleport 1.0 Release Announcement DevFeed: [Teleport 1.0 Release Announcement]() Original publisher: [Read original article]() Author: taylor@goteleport.com (Taylor Wakefield) Published: 2016-06-23T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [ssh](), [Security](), [Authentication](), [OAuth 2.0](), [openid](), [browser](), [real-time](), [GUI]() Tags: [announcement](), [audit](), [authentication](), [bastion](), [browser](), [gui](), [oauth2](), [openid](), [real-time](), [release](), [security](), [ssh]() ### AI overview Teleport 1.0 is released as a modern SSH server for server clusters, adding certificate-based authentication, session recording and replay, reverse tunneling, identity-provider integration, real-time session sharing, dynamic node labeling, and a browser-based GUI. The release also reports a completed security audit and penetration testing, with issues addressed before production recommendation. ### Source excerpt We are announcing the official 1.0 version of Teleport:\ SSH server with built-in bastion and audit! ## How to Inspect a Developer's SSH Session as Root DevFeed: [How to Inspect a Developer's SSH Session as Root]() Original publisher: [Read original article]() Author: Tom Published: 2016-04-27T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [ssh](), [configuration](), [systems]() Tags: [agent](), [bash](), [bastion](), [bastion-host](), [developers](), [how-to](), [linux](), [login](), [ssh]() ### AI overview A tutorial explains how a root user can inspect a developer's SSH session to troubleshoot login problems, including cases involving bastion hosts and SSH agent forwarding. It notes that this should only be done on systems the operator controls and is authorized to access. ### Source excerpt It happen to me all the time that one of developers notifies me about some kind of problem that I can't confirm from my account. Sometimes it was because of bad ssh keys configuration, other times file permissions, mostly such stuff. It's sometimes convenient to "enter into someone's shoes" to see what's going on there. If you're root on machine you may do that like this: Switch to developer user su developer - Easy one but that's not enough for all cases. When you use bastion host (or similar solutions) sometimes users have connection problems and it's harder to check. When such user have ForwardAgent ssh option enabled you may stole this session to check login problems. ## Use bastion host with Ansible DevFeed: [Use bastion host with Ansible]() Original publisher: [Read original article]() Author: Tom Published: 2016-04-22T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Ansible](), [ssh](), [configuration]() Tags: [ansible](), [ansible-configuration](), [bash](), [bastion](), [bastion-host](), [cloud-security](), [config](), [configuration](), [devops](), [files](), [how-to](), [infrastructure-as-code](), [jump-host](), [proxycommand](), [security](), [ssh](), [ssh-proxy]() ### AI overview A tutorial on configuring Ansible and SSH to connect to hosts behind a secured bastion or jump host. It explains how to customize ssh_config and ansible.cfg, forward SSH keys and traffic, and use connection multiplexing. ### Source excerpt Learn how to configure Ansible to connect to hosts behind a bastion or jump host by customizing your ssh_config and ansible.cfg files. ## Replacing Google Authenticator with Yubikey on OS X DevFeed: [Replacing Google Authenticator with Yubikey on OS X]() Original publisher: [Read original article]() Author: Square Engineering Published: 2013-05-28T16:03:00Z Content type: tutorial Language: en Sources: [Square Corner Blog](), [Square Corner Blog RSS Feed]() Topics: [Authentication](), [MFA](), [ssh](), [Homebrew](), [Script](), [Production Engineering]() Tags: [2](), [authentication](), [bastion](), [code](), [engineering](), [github](), [google](), [install](), [make](), [production-engineering](), [script](), [ssh]() ### AI overview A tutorial explains how to configure a Yubikey to generate TOTP codes compatible with Google Authenticator for SSH two-factor authentication on OS X. It also describes using AppleScript and Automator to enter the current code with a global shortcut. ### Source excerpt Two-factor authentication made even easier.