Re:Ask HN: How can I secure my AWS instance's SSH access if ...
by tmottabr on Friday February 18, 2022 @08:47AM
(#30385589)
is there any way to just tunnel the ssh traffic trough the bastion but let the ssh authentication be done from my computer instead?
that way i would not need to keep the keys in the bastion server at all.
Re:Ask HN: How can I secure my AWS instance's SSH access if ...
by indigodaddy on Friday February 18, 2022 @12:18PM
(#30388418)
Yes, it’s fairly trivial with ProxyCommand or ProxyJump switch:
- have minimal services running, preferably only ssh
- if you have other services running then use iptables or a firewall frontend to block all incoming ports except for the ones you specifically need/want open
- disable root ssh login
- disable password login (eg use ssh keys and preferably with a passphrase too)
- you can also use something like fail2ban or denyhosts but it’s not really necessary if you’ve also done all the above
- yum or apt update it frequently
- For your ssh connection from the bastion to your AWS instance or any other important ssh destinations from the bastion, use a key with a passphrase for increased security (on the off chance your bastion gets compromised)
- Don’t do anything else too important on your ssh bastion.. eg don’t have any important stuff or work laying around on it or other services/applications running. Just use it as a jumphost only.