{"id":1445,"date":"2022-12-26T16:34:11","date_gmt":"2022-12-26T15:34:11","guid":{"rendered":"http:\/\/www.klaushaller.net\/?p=1445"},"modified":"2022-12-26T16:34:11","modified_gmt":"2022-12-26T15:34:11","slug":"jump-hosts-admin-workstations-and-the-azure-bastion-service","status":"publish","type":"post","link":"https:\/\/www.klaushaller.net\/?p=1445","title":{"rendered":"Jump Hosts, Admin Workstations, and the Azure Bastion Service"},"content":{"rendered":"\n

The term bastion host<\/strong> is a reminiscence of medieval fortifications and everyday IT slang since long before clouds became relevant. A bastion host is a server with high exposure to external attacks and, thus, specifically secured and protected. The term covers servers with \u2013 due to their functionality \u2013 a high risk for external attacks. DNS servers are a typical example.<\/p>\n\n\n\n

The IT community also uses the term bastion hosts for jump hosts<\/strong>. The latter have a very focused purpose. Jump servers provide access to VMs (or good-old-on-prem servers) in a secure and otherwise inaccessible environment, e.g., from employee laptops or the internet.<\/p>\n\n\n\n

Jump hosts are critical in the public cloud. In the cloud, admins accessing a VM always come from cloud-external networks \u2013 but backend VMs or middleware servers should not be accessible from the internet. Jump hosts are the solution. Admins connect from their laptops to the jump host; only from there can they reach backend VMs,  e.g., SSH or RDP.<\/p>\n\n\n\n

Still, jump hosts are not helpful for all admin tasks in the cloud. They are necessary for IaaS workloads, i.e., when admins connect to VMs on the operating system level. That is not necessary for PaaS services such as Cosmos DB, for which customers do not have OS-level access.<\/p>\n\n\n\n

Understanding Jump Hosts<\/h2>\n\n\n\n

Jump hosts promise the impossible: secure the admin access to VMs in the public cloud, which, due to the nature of the cloud, always comes from the internet or a less secure network. They achieve their goal by combining three measures:<\/p>\n\n\n\n

    \n
  1. Reducing the attack surface<\/strong> of the host. Jump hosts have only one purpose \u2013 they are a host to \u201cjump\u201d to the real interesting ones. Thus, many components running on a server can be removed during the hardening, e.g., many unneeded drivers. Fewer components mean fewer components that might have vulnerabilities that attackers can exploit. Furthermore, servers support many protocols that a jump host does not need. Restricting protocols and ports is another measure to reduce the attack surface. A jump host has to access the backend VMs with RDP for Windows and SSH for Linux. All other ports should be blocked. Finally, IT organizations can ensure that admins install urgent patches immediately and first on the bastion hosts before patching any other system.<\/li>\n\n\n\n
  2. Restrict the reachability<\/strong> or connectivity of the Jump Hosts. If the admin laptops are all in a workplace zone, only ingress traffic from such zones should be allowed for the bastion hosts, thereby locking out any attacks originating, e.g., from servers in high-risk countries.<\/li>\n\n\n\n
  3. Defined point of control<\/strong>. Security operating centers have to prioritize the events they can investigate. When the operating system signals a \u201clow\u201d risk event, the SOC can investigate them for bastion hosts. However, they might not have enough security analysts to look for such events on ordinary VMs. Thus, bastion hosts imply a network topology with clear entry points, which eases prioritizing and monitoring security events.<\/li>\n<\/ol>\n\n\n\n

    In the end, this unique combination of measures and configurations makes the difference between an ordinary VM and a hardened jump host (hopefully) withstanding the most sophisticated attacks.<\/p>\n\n\n\n

    Beyond Networking: Admin Workstations and IAM in the Context of Jump Hosts<\/h2>\n\n\n\n

    Jump hosts themselves must be set up adequately, but they are also part of an ecosystem. Especially the integration in the enterprise identity and access management<\/strong> is essential. If not integrated well, the integration becomes a potential breaking point that attackers could exploit. The leaver process for removing system access from employees leaving voluntarily \u2013 or involuntarily \u2013 the organization must work as well for jump hosts, and multi-factor authentication for any login to the jump host is essential.<\/p>\n\n\n\n

    Admin workstations<\/strong> or privileged users\u2019 workstations are an additional concept that improves security with workplace-related measures. It contrasts today\u2019s work-from-anywhere zeitgeist and has the potential to annoy admins. IT organizations might want to restrict from where admins can log on to jump hosts. An implementation option could be the country from where remote workers have access, or it might even be just a few IP addresses of dedicated workstations in selected office buildings. It all depends on the organization\u2019s VMs, their criticality, and the company\u2019s risk appetite.<\/strong><\/p>\n\n\n\n

    The Azure Bastion Service<\/h2>\n\n\n\n

    Setting up a bastion host does not require Harry Potter-like magic. Many IT organizations have built and managed them for many, many years. Nevertheless, Azure offers jump hosts as a managed (PaaS) service<\/strong>. Its name: Azure Bastion. Its configuration options are limited, as Figure 1 shows. The tier level (A) is relevant if scalability is essential (i.e., many admins work in parallel), whereas other options relate to authentication implementation variants (B).<\/p>\n\n\n\n

    \"\"<\/a>
    Figure 1: Setting up an Azure Bastion Host<\/figcaption><\/figure>\n\n\n\n

    Azure Bastion\u2019s pricing<\/strong> is pure horror compared with a single VM\u2019s costs. Such a comparison lacks, however, two aspects. First, setting up and maintaining your own bastion host requires time \u2013 and engineering hours are not free. Second, applications and VMs can share a single Azure Bastion service instance by peering the bastion\u2019s Vnet and the application Vnets. For sure, these bastion hosts become even more critical elements in an application landscape because they become a single door to many VMs.<\/p>\n\n\n\n

    To conclude: jump hosts are an essential pattern for secure access to backend VMs in the cloud. You can configure your own or use a service like Azure Bastion; what matters is a comprehensive and consequent implementation.<\/p>\n","protected":false},"excerpt":{"rendered":"

    The term bastion host is a reminiscence of medieval fortifications and everyday IT slang since long before clouds became relevant. A bastion host is a server with high exposure to external attacks and, thus, specifically secured and protected. The term covers servers with \u2013 due to their functionality \u2013 a high risk for external attacks. […]<\/p>\n","protected":false},"author":1,"featured_media":1447,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,22,16,23],"tags":[64,62,60,63,37,61],"class_list":["post-1445","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","category-cloudsecurity","category-information-security","category-securityarchitecture","tag-azure-bastion","tag-bastion-host","tag-iaas","tag-jump-server","tag-network-security","tag-vms"],"_links":{"self":[{"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=\/wp\/v2\/posts\/1445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1445"}],"version-history":[{"count":1,"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=\/wp\/v2\/posts\/1445\/revisions"}],"predecessor-version":[{"id":1448,"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=\/wp\/v2\/posts\/1445\/revisions\/1448"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=\/wp\/v2\/media\/1447"}],"wp:attachment":[{"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.klaushaller.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}