How to Set Up Bastion Hosts with SSH.

functional configs, scripts and 10 best practices

1. Launch and Harden the Bastion Host

Let’s assume we have an AWS EC2 instance that will act as our bastion host. First, we update and secure the system.

Install and update packages:

#!/bin/bash
# Basic system updates
sudo apt update && sudo apt upgrade -y

# Install OpenSSH server
sudo apt install openssh-server -y

Outdated packages are basically an open invitation for attackers. We want the bastion host’s OS fully patched from day one.

2. Create a Dedicated SSH User

We don’t log in as root — that’s rule number one in SSH hygiene.

# Create a non-root SSH user
sudo adduser bastionuser

# Add to sudoers if needed
sudo usermod -aG sudo bastionuser

Then restrict root login in /etc/ssh/sshd_config:

PermitRootLogin no

Restart SSH safely:

sudo systemctl restart ssh

Root over SSH is like leaving the keys under the doormat.

3. Configure SSH Key Authentication Only

Never use passwords for SSH on a bastion.

On your local machine:

ssh-keygen -t ed25519 -C "you@example.com"

# Copy public key to bastion
ssh-copy-id bastionuser@bastion.example.com

The edit /etc/ssh/sshd_config on the bastion host:

PasswordAuthentication no
PubkeyAuthentication yes

Restart SSH:

sudo systemctl restart ssh

Keys are harder to brute-force than passwords, especially with strong algorithms like ed25519.

4. Restrict Access with Security Groups or Firewall

If you’re on AWS, allow SSH (port 22) only from trusted IPs (e.g., your office or VPN) and never expose it to0.0.0.0/0.

On the bastion:

sudo ufw allow from YOUR.IP.ADDRESS.HERE to any port 22
sudo ufw enable

If SSH is open to the world, you’ll see automated attacks within minutes.

5. Use SSH Agent Forwarding to Reach Private Servers

Instead of copying private keys to the bastion (which is a big no-no), forward your local SSH agent:

On your local machine ~/.ssh/config:

Host bastion
    HostName bastion.example.com
    User bastionuser
    IdentityFile ~/.ssh/id_ed25519
    ForwardAgent yes

Then you can connect through bastion:

ssh bastion
ssh private-server

Keeps private keys on your machine, never on the bastion.

6. Use ProxyJump for One-Command Access

Instead of SSHing twice, define a jump host:

Host private-server
    HostName 10.0.1.15
    User ubuntu
    ProxyJump bastion

Now connect with:

ssh private-server

Fewer steps = less chance of errors.

7. Enable Logging and Session Recording

Install auditd on the bastion to monitor SSH activity:

sudo apt install auditd
sudo systemctl enable auditd

Check logs:

ausearch -m USER_LOGIN

You want a trail of who accessed what and when.

8. Set Idle Timeouts

Force logout after inactivity to avoid abandoned sessions.

Edit /etc/ssh/sshd_config:

ClientAliveInterval 900       # 15 minutes
ClientAliveCountMax 0         # Force disconnect after timeout

This boots idle sessions after 15 minutes.

Then:

sudo systemctl restart ssh

Prevents abandoned SSH sessions hanging around.

9. Use Two-Factor Authentication (2FA)

For an extra security layer:

sudo apt install libpam-google-authenticator
sudo -u bastionuser google-authenticator

Update /etc/ssh/sshd_config:

ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

Enable PAM in /etc/pam.d/sshd:

auth required pam_google_authenticator.so

Restart SSH:

sudo systemctl restart ssh

Even if your key is stolen or compromised, attackers still need your OTP.

10.Monitor and Auto-Ban Intruders

Install fail2ban to block brute-force attacks:

sudo apt install fail2ban -y
sudo systemctl enable fail2ban

Default config will ban repeated failed logins.

Automatically silences repeated intrusion attempts.

Test SSH Config Changes Safely

Whenever editing sshd_config, always test in a second terminal:

sudo systemctl restart ssh

• If the second session works, close the first.
• If it fails, you’re still logged in to fix the issue.

[embed]7 DevOps weekend projects sharpen specific DevOps skills.blog.devops.dev

[embed]19 Cron Jobs for DevOps Engineers Let’s look at 19 cron jobs to somewhat make life easier, complete with explanations and examples that you can adapt to…blog.devops.dev