Setup an OpenBSD Bastion Host
We are going to be setting up a Bastion Host (or colloquially a 'Jumpbox') for our cloud infrastructure.
This should be the entry point for all future server, database, and load balancing systems.
The purpose of Bastion Hosts is simple and for one reason: to only allow the ability to SSH into your cloud infrastructure from ONE secure location. No other computers in the world will be allowed to access the rest of your machines, only this one.
Classically, you would SSH into each part of your infrastructure (DB, web server, load balancers etc.) and work on them. Most guides are set up so that you directly connect to your production server from your desktop. However, this adds a secure step in the process, stopping the greater internet from even really seeing these important parts of your setup.
How are we going to do this?
Via the most secure OS in the world - OpenBSD
Go into Vultr - use my promo code to save some money (and give me a little kickback, thank you!) and create an OpenBSD instance. From here, you will ssh into it from your main computer and begin the process of a basic setup
1. Setup SSH keys
Setup your ssh keys on your local computer by:
ssh-keygen -t rsa -b 4096 -f ~/ssh/whateverKeyNameYouWant.key -C "Jumpbox key"
This will give you two files in your .ssh directory: whateverKeyNameYouWant.key AND whateverKeyNameYouWant.key.pub
You will add that .pub key to your OpenBSD installation
2. Change root password
Get into your bastion host via:
using the password on your Vultr server details page
Now, first thing first is we will change that root password:
And enter whatever root password you want.
3. Add packages
We can add packages to our new OpenBSD installation via the following:
pkg_add packageName pkg_add neovim
I generally add neovim to all my servers, and this is no exception.
4. Create a new user
Enter as the root user:
and you will get an interactive script allowing you to name and create a new user
4.1 Add that user to wheel group
Edit /etc/group file as the root user:
and add the following:
or in the terminal:
sudo useradd -G wheel john_doe
4.2 Enable doas:
nvim /etc/doas.conf as the root user And put the following in the file:
4.3 Make sure your private key is in that USER’s .ssh/authorizedkeys
As the user you created:
or as root:
The file should look like the following:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC2SPcjFIXET7ij8LqkmuxF87HbMmnHRBlajbLPBjjIeHp7A/i8B8KY2F8ze5iZUM kpdrObuZ+zeKymuKixeb//K1zBHGercYJYhl9UJ9r03haFuYGj033BTut9m6qFO/ytyW5njTQDIfVWyXjm5988RMAdTZR+QZugFYx/ 8v4VE83DX53wNdiQlpsp+hWwPj6FgA8QT9xdsEYABywqO08+MfLVP3xOaCxtpN3PnCin6N1ZEC t+S35h61TOiujRYRvIIJOh896AtjWTJrKd+W4WcQFj0SbWcMD3+V7Wn0pMNLJBHZT9mJLLl1r7WU5Kbnlk3l7VRqkY5F8UBtTQ2dNxAY8nICtXXkcGY FpcvcSYoOpphGiAYvBapLiLmlW7cLyKgxS5wyDnN3NT1baYOlDcNJkvkf3X4CQTVbDx2Pxk1B 9+I7PFhZHIoqyRi+qF58ZhmRSvjaAgrvhMJmgo60Iw5inqcSGY3rqQpFip6dXxiCgqX72ON++7Gyi7TWPp0LkVeGMiRz3i+iuu3bb5OvBlS5zK2dvBgLv4Ot meGrZm74GsOIWr+Tjojw7ksMGzpdcussYdOwjIzRKHctLeBU18nH9zroqcC0hQnHeTBoDyjyPY0Z n/iXFKYpnm1v8K6Kme9LcKE7H9bbPHBlNFnq3G+RNVxLY1dldKXkS2IA86FQ== throwaway
5. Security and remove ability to ssh into root user:
inside /etc/ssh/sshdconfig from root:
Change the following lines and UNCOMMENT them:
PermitRootLogin -> no AuthorizedKeysFile -> .ssh/authorized_keys PasswordAuthentication -> no
Now to get into remote server you must run:
ssh -i .ssh/private_key.key firstname.lastname@example.org
Congratulations! You now have a tremendously secure Jump-in point for your cloud infrastructure that only you can access via your ssh private key.
Next, we will configure a load balancing machine.
I hope you liked this first technical post I’ve made, and I plan on doing many more in the future for the sake of documenting the journey of developing applications that are portable and scalable.