Configuring the Bastion Host on Your CloudSOE Instance

This guide covers the day-two configuration of the CloudSOE Bastion Host image on both AWS and Azure. It assumes you’ve finished one of the getting-started guides (AWS, Azure).

What’s on the box

Component	Purpose
`sssd`, `realmd`, `adcli`, `krb5-user`, `samba`, `libnss-sss`, `libpam-sss`	Active Directory join and AD-backed logins
`fail2ban`	Bans IPs that brute-force SSH (config: `/etc/fail2ban/jail.local`)
`aide`	File-integrity checking (database built at first boot)
`ntpd-rs`	Time synchronisation — Kerberos needs accurate clocks

Everything is installed but deliberately unconfigured where your environment matters (domain names, jail thresholds), so the image works as a plain key-based jump host out of the box.

Joining an Active Directory domain

The bastion can authenticate your team against AD instead of shared SSH keys. It must be able to resolve and reach your domain controllers (VPN, VPC peering or a DC in the same network):

sudo realm discover corp.example.com
sudo realm join --user Administrator corp.example.com

realm join writes /etc/sssd/sssd.conf and configures Kerberos for you. Two settings worth adjusting in the [domain/corp.example.com] section afterwards:

use_fully_qualified_names = False
fallback_homedir = /home/%u

Enable automatic home-directory creation and restart sssd:

sudo pam-auth-update --enable mkhomedir
sudo systemctl restart sssd

Then limit who may log in — a bastion should never accept the whole directory:

sudo realm permit -g 'Bastion Users'

Time skew breaks Kerberos: if a join or login fails mysteriously, check systemctl status ntpd-rs first.

Tuning fail2ban

fail2ban is enabled and starts on boot, reading the templated /etc/fail2ban/jail.local. The shipped defaults are bantime = 10m, findtime = 10m, maxretry = 5. For an internet-facing bastion, longer bans are reasonable — edit the [DEFAULT] section of jail.local:

bantime  = 1h
findtime = 10m
maxretry = 5

Then reload and inspect:

sudo systemctl reload fail2ban
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip 203.0.113.7   # rescue a locked-out colleague

If status sshd reports no such jail, enable it explicitly by adding enabled = true under the [sshd] section of jail.local and reloading.

Running AIDE integrity checks

The bastion-firstboot service built your baseline database at first boot (marker: /var/lib/bastion-firstboot.done; config: /etc/aide/aide.conf; database: /var/lib/aide/aide.db). Compare the current filesystem against the baseline:

sudo aide --config /etc/aide/aide.conf --check

Expect findings after any apt upgrade — that’s AIDE doing its job. After intentional changes, rebuild the baseline so real intrusions stand out:

sudo aideinit
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Run the check from cron or your scheduler of choice and ship the output somewhere a tampered host can’t reach — see tips & tricks.

Next steps

Tips & tricks — ProxyJump blocks, session recording, AIDE hygiene and network lockdown