Bastion Host
System Analysis
Normal Behavior
An engineer connects to the bastion host via SSH/RDP, authenticating using multi-factor authentication (MFA) or short-lived cryptographic certificates issued by an Identity-Aware Proxy (IAP). The bastion validates the session, records all terminal input/output keystrokes to an immutable audit log, and establishes a secure TCP tunnel or forward proxy session to internal target instances located in private subnets.
Failure Behavior
If the bastion host's SSH daemon exhausts available file descriptors or connection limits (MaxStartups) during a major incident, engineering responders are locked out of the entire internal cloud environment. Additionally, if the bastion host is compromised due to unpatched operating system vulnerabilities or stolen private SSH keys, an attacker gains unrestricted lateral movement into the private internal network.
Business Consequence
When a bastion host is compromised or goes offline, either malicious actors gain unfettered SSH access to private enclaves, or legitimate administrators are entirely locked out of production systems during a critical incident.
Visual Manifestation
"Unusual SSH login spikes on the perimeter firewall logs or connection timeout errors for all engineers trying to access internal VPC resources."
Satirical Behavior
"A single Linux server with a highly publicized IP address, designed to make sure hackers only have to guess one password to ruin your weekend."
Technical Terminology
Failure Indicators
System Architecture (Graph)
FAQ
How does it normally behave?
An engineer connects to the bastion host via SSH/RDP, authenticating using multi-factor authentication (MFA) or short-lived cryptographic certificates issued by an Identity-Aware Proxy (IAP). The bastion validates the session, records all terminal input/output keystrokes to an immutable audit log, and establishes a secure TCP tunnel or forward proxy session to internal target instances located in private subnets.
How does it fail?
If the bastion host's SSH daemon exhausts available file descriptors or connection limits (MaxStartups) during a major incident, engineering responders are locked out of the entire internal cloud environment. Additionally, if the bastion host is compromised due to unpatched operating system vulnerabilities or stolen private SSH keys, an attacker gains unrestricted lateral movement into the private internal network.
What is the business consequence?
When a bastion host is compromised or goes offline, either malicious actors gain unfettered SSH access to private enclaves, or legitimate administrators are entirely locked out of production systems during a critical incident.
Why is traditional SSH key-based bastion access being replaced by Identity-Aware Proxies (IAP)?
Static SSH key pairs stored on developer laptops are vulnerable to theft, difficult to rotate, and impossible to revoke instantaneously upon employee departure. Modern Identity-Aware Proxies (e.g., AWS Systems Manager Session Manager, Teleport, Cloudflare Access) replace open bastion SSH ports with ephemeral, identity-authenticated HTTPS tunnels tied directly to corporate Single Sign-On (SSO) and zero-trust policies.
How should a bastion host be hardened against external perimeter attacks?
Hardening involves disabling root login, enforcing multi-factor authentication (MFA), disabling password authentication in favor of short-lived SSH certificates, restricting ingress IP ranges via strict security groups, running non-standard ports, enabling automated session recording (e.g., auditd or teleport), and stripping all compilers and non-essential software packages from the host image.
Explore the system
AI Summary
Bastion Host is a SECURITY_IDENTITY_AND_TRUST system in TinyCTO.tv. An engineer connects to the bastion host via SSH/RDP, authenticating using multi-factor authentication (MFA) or short-lived cryptographic certificates issued by an Identity-Aware Proxy (IAP). The bastion validates the session, records all terminal input/output keystrokes to an immutable audit log, and establishes a secure TCP tunnel or forward proxy session to internal target instances located in private subnets.