SSH Jump Server

In recent times, there is an increasing need for organizations to give employees access to their IT facilities due to the ongoing Covid restrictions ( such as work from home ) in place and in other cases grant access to external parties like clients, vendors who wants to troubleshoot and fix issues with the IT Infrastructure remotely.

Nov 25, 2022 - 18:18

Introduction

In recent times, there is an increasing need for organizations to give employees access to their IT facilities due to the ongoing Covid restrictions ( such as work from home ) in place and in other cases grant access to external parties like clients, vendors who wants to troubleshoot and fix issues with the IT Infrastructure remotely.

More so, is the need for multiple manage SSH access to the company’s Linux servers, Routers, Switches, while meeting regulatory and security compliance.

This need led to the emergence of the SSH Jump Server concept.

It is a secure intermediary server where all your system administrators would login in first via SSH before getting to access the remote devices such as Linux instance, Routers, Switches etc. The purpose of having the SSH Jump server is to improve security and consolidate SSH user activities to a single point hence better security and accountability. SSH Jump server is also known by the name SSH Jump Box, SSH Jump Host & SSH Gateway.

What is SSH Jump Server and how does it work?

An SSH Jump Server is simply a single, hardened server that you “jump” through in order to access other servers or devices on the inner network.

Sometimes called a SSH Jump host , or SSH Jump server or ssh bastion host or a relay host, it’s simply a server that all of your users can log into and use as a relay server to connect to other Linux servers, Routers, Switches and more. Therefore, a jump server is a server inside a secure zone, which can be accessed from a less secure zone. It is then possible to jump from this host to greater security zones.

In other words, it is an intermediary host or an SSH gateway to a remote network, through which a connection can be made to another host in a dissimilar security zone, for example a demilitarized zone (DMZ2). In short it is intended to breach the gap between two security zones. This is done with the purpose of establishing a gateway to access something inside of the security zone, from the DMZ

The SSH Jump Box bridges two dissimilar security zones and offers controlled and monitored access between them.

For users accessing your secure network over the internet, the jump host provides a highly secured and monitored environment especially when it spans a private network and a DMZ with servers providing services to users on the internet.

Furthermore, a classic scenario is connecting from your desktop or laptop from inside your company’s internal network, which is highly secured with firewalls to a DMZ. In order to easily manage a server in a DMZ, you may access it via a jump host.

Therefore, a jump host is a server inside a secure zone, which can be accessed from a less secure zone. It is then possible to jump from this host to greater security zones. An example would be a high security zone inside a corporation. The policy guide states that this zone cannot be accessed directly from a normal user zone. Hence, in a DMZ off the firewall protecting this zone you have a jump host.

Connections are permitted to the ssh jump host from the user zone, and access to the secure zone are permitted from the jump host.

More often, there is a separate authentication method for the jump host fortified with multi factor authentication, Single Sign On ( SSO ) , Radius & more.

How to Configure an SSH Jump Server

Using OpenSSH
A basic ssh jump server with limited features and functionalities can be configured using OpenSSH packages that available by default on most Linux distributions. In the example below, we will just use the basic ssh command line to proxy a ssh connection to the remote server via a intermediate jump server.

ssh -J jump_machine remote_machine

If the -J option is not available use the -W option to pivot the connection through an intermediate bastion host.

ssh -o ProxyCommand="ssh -W %h:%p bastion.gateway.org"  remote.server.org

With the OpenSSH 7.3, the easiest way to pass through hop through intermediate one or more jump hosts is using the ProxyJump directive ssh_config

Host remote server
    HostName 192.168.0.177
    ProxyJump admin@jump-server.org:22
    User devops

Multiple jump hosts can be chained as well

Host remote server
    HostName 192.168.0.177
    ProxyJump admin@jump-server.org:22, admin@jump-server2.org:22
    User devops

Do refer the article SSH Proxy and SSH JumpHost for configuring a basic jump server that is very limited in feature and functionality when compared to the modern day ssh jump host solutions.

Using Ezeelogin SSH Jump server
Ezeelogin is a much more powerful and advanced SSH Jump host software solution and can be deployed quickly. It has powerful features that makes managing hundreds of Linux devices and granting ssh access to these device a piece of cake. Do refer the article to configure a ssh jump server quickly on your premise or on cloud.

Why do you need a SSH Jump server solution to manage ssh access?

The OpenSSH based jump server is clearly not enough to meet the modern day requirements of an IT enterprise. The challenges for the enterprise are constantly changing and dynamic . On day , it could be from maintaining security, granting ssh access to the users to designated server and that too for particular time and on another day it could be the security compliances that needs to be met at the time of a Linux servers infrastructure audit.

The modern day SSH Jump host solutions are designed to address the challenges faced by an IT enterprise when it comes to security and to meet various security compliances like PCI DSS, NIST, ISO 27001 and more.

The modern day ssh jump server software has the following features and more.

Identity and Access management (IAM)
Privileged Access management (PAM),
Role Based Access Control to delegate access to Linux servers and Network devices.
Two factor authentication methods like Google Authenticator, DUO Security 2FA, & Yubikey in SSH.
Integrates with Windows Active Directory, OpenLDAP, Redhat IDM.
Supports SAML for Single Sign On.
Support RADIUS Authentication to access network devices such as Routers and Switches
Password Manager
SSH key rotation,
Automated root password management

OpenSSH proxy or jump server cannot perform all these advanced activities.

Limitations of normal openssh jump servers:-

The OpenSSH jump servers hold the ssh-certs in plain text format. Since the jump server is a trusted device, any intruder with sufficient privileges can jeopardize the entire network.
An OpenSSH jump server does not have any mechanism to detect user impersonation, i.e., using another one’s login to access the server. The system will let you in if you have valid login credentials.
Routine activities such as user or server addition, removal, setting privileges, or security management takes a lot of system administration time.
Logging the user activities on the remote server from the jumpserver is impossible without placing an agent software on the server.
Jump server management is through the command-line interface. If you are not a competent Linux administrator, you must hire someone, increasing operational expenses.
Migrating or upgrading a jump server is a tedious process with a high probability of downtime.
Integrating with other authentication systems or exporting multiple users from systems such as Active Directory or LDAP are not supported.
Many companies adopt OpenSSH jump server implementation to avoid the costs of purchasing custom-made ssh jump server solutions. But the inherent limitations of ssh jump server cost them dearly by denting their development possibilities.
The lack of fail-over systems makes the entire network inaccessible in the event of jump server failure.

Only an ssh jump server solution that moves abreast with the technological and industry demands alone can ensure you a smooth growth trajectory. Ezeelogin, with its innovative features, robust security, and exceptional user experience, helps companies worldwide to scale new heights with absolute confidence.

Jump server best practices

To ensure maximum protection of your ssh jump server, you should focus on the process of server security hardening. In simple terms, that means applying a combination of basic and advanced security measures to address vulnerabilities in your bastion host server and operating system to boost overall server security.

Find how to secure your ssh jump server

Jump server comparison:

OpenSSH Vs. Ezeelogin

OpenSSH Jump Server	Ezeelogin Jump Server
Only password or cert-based authentication	Supports 2FA – Google Authenticator, Yubikey, and Duo
Stores SSH Keys in plain text format	The encrypted keys are stored in databases
Uses default shells. No customization is possible.	Uses custom shell – ezsh
Can’t restrict command execution	Command-Line Guard restricts the user from executing dangerous commands.
Login works only for command line	Both command line and WebSSH login works
Needs professional Linux administration skills	Only a few mouse clicks are required. No server admin expertise is essential.
Command execution on multiple servers requires separate ssh logins.	Parallel shell enables simultaneous execution of commands across multiple servers.
User activity session recording is possible only through agent software.	No agent software is required for ssh session logging.
Password Reset, Rotation, and login sharing are quite clumsy processes.	Password management is automated.
Single point of failure – you can’t access your servers if the jump server is down.	Master-slave architecture to avoid the single point failure
Achieving security compliance is hard.	Can easily fulfill security compliance requirements
Permits access only for system users.	Login for LDAP and Active Directory users is possible.

CONCLUSION

IT Enterprises that use a Ezeelogin SSH Jump Server solution in improving security of their critical IT asset and in meeting various mandatory security compliances (which would otherwise prove very costly in case of a breach), are more likely to succeed due to the improved operational efficiency, digital security, hence more successful business for the company’s end customers. Ezeelogin jump server helps the organizations worldwide to unleash their growth potential without any limitations and helps them grow bigger and bigger without any server management worries.

Click Here To See More