Getting Started

Getting Started with the Bastion Host on AWS

2026-07-30 · bastion-host docs · aws

The CloudSOE Bastion Host image is a hardened SSH jump host on Ubuntu: fail2ban brute-force protection, the AIDE file-integrity checker (its database is initialised on your instance at first boot), ntpd-rs time sync, and a full Active Directory join toolchain (sssd, realmd, adcli, Kerberos, Samba) preinstalled but unconfigured. There are no baked-in credentials — access is your SSH key, nothing else.

What you’ll need

  • An AWS account subscribed to the CloudSOE Bastion Host listing on AWS Marketplace
  • An EC2 key pair in your target region (SSH is key-based only; password login is disabled)
  • About five minutes

Step 1 — Launch the instance

  1. Open the Bastion Host listing on AWS Marketplace and click Continue to Subscribe, then Continue to Configuration.
  2. Pick your region and click Continue to Launch → Launch through EC2.
  3. Choose a small instance type — a bastion forwards SSH traffic, so t3.small is plenty for most teams.
  4. Select your key pair and launch into a public subnet of the VPC that contains your private instances.

Prefer the CLI? Once subscribed:

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type t3.small \
  --key-name my-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=bastion-01}]'

Step 2 — Open exactly one port

PortProtocolPurpose
22TCPSSH — restrict to your office/VPN ranges

That’s the whole table. A bastion’s value is its tiny attack surface: no other inbound rule belongs in this security group, and port 22 should be limited to known source ranges, not 0.0.0.0/0. On the private instances’ security groups, allow port 22 from the bastion’s security group only.

Step 3 — Let first boot finish

On the very first boot the bastion-firstboot service initialises the AIDE integrity database — a fingerprint of your instance’s files that later checks compare against. It runs in the background and can take a few minutes; the bastion is usable immediately. Check it:

ssh ubuntu@<public-ip>
systemctl status bastion-firstboot

fail2ban starts automatically at boot and begins watching the SSH log:

sudo fail2ban-client status sshd

Step 4 — Jump to a private instance

The whole point of a bastion — reach instances that have no public IP:

ssh -J ubuntu@<bastion-public-ip> ubuntu@<private-instance-ip>

-J (ProxyJump) tunnels through the bastion without leaving your private key on it. Don’t copy private keys to the bastion, and prefer ProxyJump over agent forwarding (-A) — with ProxyJump the bastion never sees your agent at all. Make it permanent with an SSH config block — see tips & tricks.

Next steps