SSH Bastion Host Best Practices

Re:SSH Bastion Host Best Practices by geunsgucndb on Friday January 14, 2022 @12:38AM (#29930980)

If you use SSM instead of a bastion host, how do you tunnel traffic to internal services that are not exposed to the internet?

[ Parent | on HN ]

Re:SSH Bastion Host Best Practices by mrweasel on Friday January 14, 2022 @02:19AM (#29931508)

I haven't actually tried it, but you can use SSM in your ssh config as a ProxyCommand. As I understand it, that will allow you to just use the ssh command as normal, with all the normal ssh abilities to do tunneling and port forwarding.

[ Parent | on HN ]

Re:SSH Bastion Host Best Practices by wmfiv on Friday January 14, 2022 @12:19PM (#29937190)

Yes that's right. You can use SSM to port forward. Here's an example of the SSH configuration.

host i-* mi-*

    ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS-StartSSHSession"

[ Parent | on HN ]