Implement Bastion (aka JumpBox) with MFA Support - Githubissues

cloudposse / bastion

🔒Secure Bastion implemented as Docker Container running Alpine Linux with Google Authenticator & DUO MFA support

https://cloudposse.com/accelerate

Apache License 2.0

643 stars 112 forks source link

Implement Bastion (aka JumpBox) with MFA Support #1

Closed osterman closed 7 years ago

osterman commented 7 years ago

what

support Google Authenticator & Duo as MFA providers
leverage minimal Alpine Linux distribution
Extendable framework to audit SSH commands using ForceCommand and /etc/enforce.d rules
Extendable framework to initialize bastion prior to starting SSH using scripts in /etc/init.d
SSH audit logs capture session information
Easily enable/disable scp
SSH version obfuscation

why

a secure bastion is one of the best practices of exposing a cluster on the public internet
MFA with public key encryption helps ensure that users connecting are who they say they are
No root access (by default) helps ensure safe guards (such as SSH audit logs) cannot be disabled or tampered with

todo

[x] documentation

who

@cloudposse/engineering