Running unnecessary services only increases the attack surface of the bastion host. For example, an SSH bastion host should only be running sshd daemon and nothing else. Once the right server OS is used, ensure that only required services are installed and run. If you or your team are comfortable with any particular OS, go for it. As for picking up the right distribution, understand that any system is as secure as how properly you know the system and configure it. For example, refer to these websites that should guide you in installing a minimal OS: ubuntu minimal, debian netinst, and centos. Your bastion host may not need all of these packages! It is a good practice to review all of the pre-installed packages and remove those that are not required for your bastion host.Ī rule of thumb is to use minimal OS images and installation packages as required. Similarly, $ yum list installed | wc -l command shows there are 453 packages pre-installed in a fresh AWS Amazon Linux 2 server image. Quickly checking with $ dpkg-query -W | wc -l command shows there are 567 packages pre-installed in a fresh AWS Ubuntu 20.04 LTS server image. 14 best practices to secure bastion hostīelow are the 14 best practices to secure bastion hosts, including hardening server OS, hardening OpenSSH authentication and cryptographic operations, and deploying the host with high availability. Since the services behind the bastion are configured to trust incoming connections from the bastion host, principles of zero trust networking should be applied so that incoming connections from the bastion host are further verified, which would help in case the bastion host is already compromised. Thus, security of both the server deployed as a bastion host and the network in which the bastion host will be placed must be carefully considered as an attack surface for bastion host exploitation. OS and network exploitation) or find a network policy misconfiguration that allows bypassing the bastion host entirely. Bastion host attack surfaceĪdversaries can either compromise a bastion host (e.g. If you want to learn more about the security importance of bastion hosts, read our blog on why bastion hosts are an indispensable security enforcement stack for secure infrastructure access. If you are looking for a quick guide on creating an SSH bastion, check our previous blog post on setting up an SSH Bastion. This blog post focuses on following best practices on building and deploying a secure SSH bastion server based on OpenSSH. Additionally, insufficient resources may give attackers the chance to execute Denial of Service attacks which may cause service downtime. The placement of bastion hosts in the infrastructure also plays an important role because an improper network configuration may allow attackers to completely bypass the bastion host and directly reach their target server. The core concept of security hardening a bastion host is to run a bastion server with minimal components and reduce the attack surface as much as possible. After all, bastion hosts are the first target for attackers looking to compromise access to infrastructure. Although it is relatively easy to deploy a bastion host in your infrastructure, securing a bastion host requires careful consideration from design to deployment.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |