Bastion Host

The CloudSOE Bastion Host image is a purpose-built SSH jump server on a hardened Ubuntu base with SSSD, realmd, Kerberos and Samba tooling for joining Active Directory domains, fail2ban for brute-force protection, ntpd-rs time sync and AIDE file-integrity monitoring initialised on first boot. Key-based SSH only — passwords are disabled.

All software in this project is the intellectual property of its respective owners. CloudSOE packages and distributes these images under applicable licences and does not claim ownership of the underlying software. Original software by CloudSOE.

Documentation

AW AWS Marketplace AZ Azure Marketplace

Documentation

Step-by-step guides for this image.

Getting Started with the Bastion Host on AWS Launch the CloudSOE Bastion Host image from the AWS Marketplace, open only port 22, and start jumping to your private instances with ssh -J.
Getting Started with the Bastion Host on Azure Deploy the CloudSOE Bastion Host image from the Azure Marketplace, allow only port 22 in your network security group, and start jumping to private VMs with ssh -J.
Configuring the Bastion Host on Your CloudSOE Instance Day-two setup for the CloudSOE Bastion Host — joining an Active Directory domain with realmd/sssd, tuning fail2ban jails, running AIDE integrity checks and verifying time sync.
Bastion Host Tips & Tricks on CloudSOE Images ProxyJump SSH config blocks, agent-forwarding hygiene, session recording ideas, keeping the AIDE database current and locking down bastion network access.