SSH Bastion Host Best Practices

Re:SSH Bastion Host Best Practices by mlyle on Friday January 14, 2022 @12:45AM (#29931024)

I suggest:

   AllowAgentForwarding no
   AllowTcpForwarding yes
   X11Forwarding no
   PermitTunnel no
   GatewayPorts no
   PermitOpen *:22
   ForceCommand echo 'Nope'

Then:

    ssh -J finaluser@finalhost user@bastion

You can nicely use your local agent, etc. Bastion is relatively hardened. Etc.

[ Parent | on HN ]

There are no comments on this comment yet.