Bastion Host: Secure SSH Access to Private Servers

Bastion Host: The Single Entry Point to Your Private Infrastructure

Imagine you have 50 servers in private subnets, none with a public IP. To connect, developers would copy keys to each server? Or open SSH on all instances? Both options are security holes. According to statistics, most incidents stem from improper access management. We've encountered this many times and know how to fix it.

A bastion host is the single controlled entry point to your entire private infrastructure. Instead of 50 open ports, you get one jump host with strict hardening. Access is via SSH ProxyJump, without copying keys to the bastion. Sessions are recorded, every connection is logged. We set up such solutions turnkey — from a simple bastion to integration with Teleport or AWS SSM. We'll assess your project in one day.

How a Bastion Host Reduces Security Risk?

Any security audit (PCI DSS, SOC 2) requires isolating access to production. A bastion minimizes the attack surface: you open one port on the bastion, and only from a whitelist of IPs. Full session control — who, when, what they did. Without a bastion, this is impossible. According to NIST SP 800-207, a minimal configuration should include a bastion for access to critical systems. License savings when using a bastion instead of a VPN can reach 70%. The cost of a single security incident can be many times higher.

Architecture: How We Build a Bastion in AWS

A typical scheme from our engineers: a bastion in a public subnet with an Elastic IP, all EC2 instances in private subnets. The bastion Security Group accepts SSH only from office IPs (e.g., 203.0.113.0/24). Internal servers' Security Group allows SSH only from the bastion. No 0.0.0.0/0. Example Terraform:

resource "aws_security_group" "bastion" {
  name = "bastion-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port = 22
    to_port = 22
    protocol = "tcp"
    cidr_blocks = var.allowed_cidr_blocks # ["203.0.113.0/24"]
  }

  egress {
    from_port = 0
    to_port = 0
    protocol = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "internal" {
  name = "internal-servers-sg"
  vpc_id = var.vpc_id

  ingress {
    from_port = 22
    to_port = 22
    protocol = "tcp"
    security_groups = [aws_security_group.bastion.id]
  }
}

What If You Have No Public IPs?

If your infrastructure is completely isolated, use AWS SSM or Azure Bastion. These services don't require a public IP — access is via API with IAM authentication. But for interactive work, a bastion is faster: SSM latency is 200–500 ms higher. We often combine: bastion for SSH, SSM for automation.

Practical Example: Bastion for Kubernetes

In one project, we set up a bastion for access to the Kubernetes API. We had a private EKS cluster in a VPC with no public access. DevOps engineers needed to run kubectl and helm. The solution: a bastion with kubectl and helm installed, and a kubeconfig configured through AWS IAM Authenticator. Access was via ProxyJump with MFA. This fully isolated the API server while providing developers with a convenient interface. The entire process is documented in a runbook we deliver to the client.

How to Set Up a Bastion in 5 Steps

1. Choose a distribution — Ubuntu LTS, minimal packages, only SSH.
2. Apply a Security Group — allow SSH only from your IPs (office/VPN), deny everything else.
3. Configure SSH ProxyJump on client machines (see config below).
4. Enable MFA via Google Authenticator or Duo.
5. Activate session recording — tlog, auditd, or SSM.

Example ~/.ssh/config for transparent access:

Host bastion
    HostName 203.0.113.10
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60

Host *.internal
    User ubuntu
    IdentityFile ~/.ssh/id_ed25519
    ProxyJump bastion

After that, ssh app-server-01.internal connects automatically through the bastion. For scp: scp -o ProxyJump=bastion file.tar.gz app-server-01.internal:/tmp/.

Bastion vs AWS SSM: What to Choose?

SSM is good for simple scenarios, but for frequent interactive work, a bastion is faster and more familiar. We often combine: bastion for SSH, SSM for automation. Additionally, a bastion reduces the cost of security incidents when properly configured.

What Security Measures Are Mandatory on a Bastion?

Basic hardening on the bastion:

sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config
echo "AllowUsers bastion-user" >> /etc/ssh/sshd_config
echo "Port 2222" >> /etc/ssh/sshd_config
systemctl reload sshd

fail2ban to block brute-force:

[sshd] enabled = true maxretry = 3 bantime = 3600 findtime = 600 

MFA via libpam-google-authenticator is mandatory for production. For teams of 10 or more, integrate with Duo or Okta through RADIUS. This provides two-factor authentication on top of SSH keys.

Bastion host setup checklist:

• Minimal distribution (Ubuntu LTS, Debian, Alpine)
• SSH on a non-standard port
• Keys only + MFA
• fail2ban with maxretry=3
• Security Group with IP whitelist
• Session recording (tlog, auditd)
• Regular updates

Process: From Audit to Deployment

1. Audit current infrastructure — analyze VPC, Security Groups, existing access methods.
2. Design architecture — scheme with bastion, routing, redundancy.
3. Deploy via Terraform — create bastion host, Security Groups, NAT if needed.
4. Configure SSH and MFA — hardening, ProxyJump, integration with corporate IdP.
5. Test and document — verify connections, write instructions for the team.
6. Train and support — explain the process, provide runbook.

Timeline and Cost

Basic bastion setup with hardening takes from 3 to 5 hours. Integration with SSM or Teleport takes from 1 to 2 work days. Cost is calculated individually based on infrastructure complexity and audit requirements. On average, license and administration savings reach up to 70% after implementation.

What's Included in Turnkey Bastion Setup

• Architecture design (VPC schema, Security Groups, NAT)
• Bastion deployment via Terraform/CloudFormation
• SSH ProxyJump configuration and team configs
• MFA (TOTP or corporate)
• Session audit system (tlog, auditd, or Teleport)
• Documentation and team training

We guarantee that after setup, you will pass any audit. Our engineers have 7+ years in DevOps and over 50 infrastructure security projects.

Order bastion setup — get a consultation and project assessment. Contact us today.