Try transparent sessions with HCP Boundary

At HashiConf this year, we announced the release of Boundary 0.18 with transparent sessions. Transparent sessions make it easier than ever to securely connect to your endpoints and infrastructure. This blog post will address how to set up a new HCP Boundary cluster, so you can use transparent sessions.

Sign up for HashiCorp Cloud Platform

If you don’t have an HCP account, follow the sign up process and create a new organization (for example: my-hashicorp-org). A default project will be created for you.

[embed]

Follow along in our companion video.

Create your HCP Boundary cluster

Follow the link on your HCP dashboard to create your HCP Boundary cluster. Choose a name for your new cluster (for example, my-boundary-cluster). Choose a tier. All HCP tiers include support for transparent sessions, so we can pick the Standard tier. Set up an initial administrator login with a username and password of your choice. You will be able to configure alternative authentication methods once the cluster has been deployed. The cluster creation takes about 5 minutes. Copy the URL for your cluster. It will look something like this:

https://624fcca9-7a74-4edb-b50c-9de8c15815d2.boundary.hashicorp.cloud

Create your first target

Once the cluster has finished creating, you can login to it using the administrator credentials you created in the previous step. Once you login, you will be prompted to set up a first target. Transparent sessions supports protecting HTTPS endpoints, so for this tutorial we will add a target for the www.hashicorp.com website. Enter www.hashicorp.com in the Target Address field and 443 in the Default Port field. The new target will be created in an auto-generated Boundary Org and Project.

Assign an alias to your target

Aliases allow operators to add friendly names for resources within Boundary, which are easier to type and remember than the auto-generated IDs. After creating the target in the previous step, we are taken to the details page for that target. On the right hand side of this screen, we can see the “Add an Alias” button. Click the button, which will take you to the screen to create an alias. On the new screen, you can optionally assign a Name and Description, but the only important thing is to set an Alias value. The Alias value is used by transparent sessions to identify a target when a user makes a connection on their machine. Set this value to www.hashicorp.com and scroll to the bottom to save the new Alias.

Download the Boundary installer

The Boundary installer, new in Boundary 0.18, can be downloaded from Boundary install page. Pick the version of the installer matching your system. The installer supports the Microsoft Windows and Apple Mac operating systems. Run the installer to install the Boundary Desktop client, Boundary CLI, and the Boundary Client Agent. The Boundary Client Agent is what makes transparent sessions possible. To learn more, see our documentation.

Sign in to the Boundary Desktop Client

After installation, open the Boundary Desktop Client. Copy the cluster URL from step 2 and enter it into the cluster URL field and sign in using the administrator credentials you created. You will be presented with the dashboard, showing your targets.

That’s it

That’s it! Now, try loading https://www.hashicorp.com in your browser. It should look just like it normally would, but it will be served to you through a Boundary session created by the Boundary Client Agent. You can verify this by running the following command in a terminal:

$ boundary client-agent sessions

This will show the session that was created when you opened the website in your browser. Now you can begin to see the power of transparent sessions in simplifying access to privileged resources.

Your next target

Try adding another target, this time using the SSH target type. Add an injected credential to authenticate to the SSH host. Assign an alias, for example, my-ssh-target.boundary.dev. Wait a minute or two for the client agent to pick up the new alias, and then try to SSH to the alias value.

$ ssh my-ssh-target.boundary.dev

This will automatically route your SSH session through a Boundary session, injecting the credential along the way, allowing you to configure both secure and convenient access to your resources.

Further reading

• Boundary docs & tutorials
• Getting started with HCP Boundary
• Boundary transparent sessions demo
• Boundary self-managed workers
• Boundary multi-hop sessions