Secure Bastion Host Deployment and Hardening

This skill covers bastion-host architecture, configuration, and hardening - designing secure jump servers that provide controlled access to private networks, across AWS/Azure/GCP, on-premises, and hybrid environments. Core principles: security-focused design (minimal attack surface - install only necessary services and packages; deny-by-default - block all unneeded traffic and services; least privilege; defense-in-depth with layered protection and monitoring; audit everything - log and monitor all access attempts and activity). Network architecture: place bastion hosts in dedicated public subnets or a DMZ, use separate subnets for bastions versus target resources, enforce strict security-group and firewall rules, consider multiple bastions for high availability, and use load balancers to distribute bastion traffic where needed.

AWS implementation is shown via Terraform IaC, including a bastion security group:

### Bastion Host Security Group
resource "aws_security_group" "bastion" {
  name_prefix = "bastion-sg"
  vpc_id      = var.vpc_id

  # SSH access from specific IP ranges only
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = var.allowed_cidr_blocks
  }

  # Outbound access to private subnets
  egress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.private_subnet_cidr]
  }

  # HTTPS for package updates
  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "bastion-security-group"
    Purpose = "Bastion Host Access Control"
  }
}

and a bastion EC2 instance with detailed monitoring, EBS optimization, and IMDSv2 enforcement (http_tokens = "required"), bootstrapped via a user_data script referencing a CloudWatch log group. The hardening script updates packages, hardens sshd_config (no root login, pubkey-only auth, no empty passwords, verbose logging, session timeouts, max 3 auth tries), installs an SSH warning banner, configures fail2ban (a 1-hour ban after 3 failed attempts in 10 minutes), sets up rsyslog for auth and activity logging, configures the CloudWatch Logs agent to ship /var/log/secure and the bastion auth log, removes unnecessary dev packages (gcc, make, kernel-devel), and locks down sshd_config file permissions.

Advanced security settings cover MFA (installing Google Authenticator, adding pam_google_authenticator.so to the SSH PAM stack, requiring publickey,keyboard-interactive auth methods) and session recording (installing tlog, configuring tlog-rec-session.conf to log to file and syslog, and setting tlog-rec-session as the shell for users requiring recorded sessions). Monitoring and alerting is shown via Terraform CloudWatch resources: a metric alarm firing on more than 5 SSH auth failures in a 5-minute period (notifying an SNS topic), fed by a log-metric filter matching "Failed*" patterns in the bastion log group.

Best practices cover access control (AWS Systems Manager Session Manager for temporary access, IAM roles and policies for granular control, regular SSH key rotation and access review, SSM Session Manager as a traditional-SSH alternative), network security (VPC Flow Logs, NACLs as an extra layer, AWS PrivateLink for internal-service access, regular port and service scanning), operational excellence (automated bastion deployment and configuration, blue-green deploys for updates, incident-response runbooks, regular disaster-recovery testing), and compliance and audit (CloudTrail for API-call logging, VPC Flow Logs analysis, centralized log aggregation, regular security assessments and pentests, documented access patterns and authorized users). Alternative solutions noted: AWS Systems Manager Session Manager for browser-based access, zero-trust network access (ZTNA) solutions, Teleport or other identity-aware access proxies, and HashiCorp Boundary for dynamic credential management.

Use it when designing, hardening, or auditing a bastion or jump host for controlled access to a private network - Terraform-based provisioning, SSH hardening, MFA, session recording, or monitoring and alerting on auth failures. It is not a general network-security or IAM guide beyond the bastion itself - though it references modern alternatives (SSM Session Manager, ZTNA, Teleport, Boundary) worth considering instead of a traditional bastion.

Given a cloud environment and access requirements, it produces Terraform IaC for the bastion instance and security group, a hardening bootstrap script, MFA and session-recording configuration, and CloudWatch alarm definitions for auth-failure monitoring.

Built on AWS (EC2, Security Groups, CloudWatch, CloudTrail, SNS, IAM, SSM Session Manager), Terraform/HCL, and Linux tooling (sshd, fail2ban, rsyslog, tlog, the Google Authenticator PAM module); references Teleport and HashiCorp Boundary as alternative access-proxy solutions.

Cloud and security engineers designing, hardening, or auditing bastion-host access to private networks.