Hostname refers to the IP address of the bastion host.This makes sure that the user can SSH into the Bastion server by just typing ‘ssh bastion’ from the command line interface.Bastion Host needs to be accessed with the help of SSH. This is used to set up the SSH forwarding via the local machine to the bastion host so that the file used to access the EC2 instance is made available only when the user tries to connect to one of the servers.Username refers to the person who has the rights to login to the server. The reason behind limiting the usage of bastion host to a specific instance/requirement is to avoid formation of unnecessary security loopholes.Steps to create a bastion host for a specific AWS infrastructureFollowing are the steps to create a bastion host:Sign into your AWS account.Create an EC2 instance or launch an EC2 instance which was previously defined.Harden the OS, which basically refers to increasing the security which has been provided by the OS.Specify appropriate security groups or create a security group for the bastion host.This will open up the port 22 which is usually used with SSH.Select a source, which is done to ensure that relevant people (who have access to add their IPs) have access to the Bastion host.The security groups of the current instances have to be changed to make sure that inbound SSH (if any) can be accessed through the Bastion Host’s IP address only.The local ~/.ssh/config file has to be edited to reflect the bastion host name, username, and a ‘Yes’ value for the ForwardAgent field. After a connectivity (remotely) is established with the bastion host, it allows using SSH or RDP to log in to other instances (thereby behaving like a ‘jump server’), that are present within the private network/subnet.Once the connection is properly configured with the help of security groups and network ACLs (NACL), bastion host behaves like a bridge between the private instances of the service and the internet, thereby protecting the instances from attacks outside.When is a bastion host needed?If a user is confused whether they need a bastion host or not, ponder over the question- Do I need remote connection to my private instance of a service, through the public internet? If the answer to this question is ‘Yes’, then a bastion host is required, otherwise it is not needed.The below snip shows how a bastion host can be used to connect to a private instance of the AWS infrastructure:Designing a bastion host for AWS infrastructureA bastion host designed to work with a specific infrastructure should work with that unit only, and nothing else. This usage place with the help of many authentication mechanisms making sure that the system is safe.These hosts are accessed with the help of SSH or RDP protocols. It is a powerful server, which provides high-level network security, since it is the only host that is granted permission to access the public network.This machine can be used by system administrators to connect to other instances of service, which happens in the infrastructure backend. It has access to the public network, and it also known as a ‘Jump Box’. The machine contains a single application only, which it hosts. This is when bastion host comes into the picture.A bastion host can be thought of as a special purpose machine, which has been configured to work against attacks. Even though Amazon provides excellent security with its services, it is strongly suggested by Amazon to use SSH access to further secure the services and their instances. AWS Tutorials By KnowledgeHut Security is a prime concern for almost any company, which use the services to store their own data.

Bastion definition