SSH in Bastion Mode

This chapter contains an example of a basic Fudo Enterprise configuration, to monitor SSH access in bastion mode. In this scenario, the user connects to the remote server over the SSH protocol and logs in to the Fudo Enterprise using an individual login and password combination (john_smith/john). The user specifies user name along with account login on the target server and target server address in the login string (john_smith#root#192.168.0.110) and connects to it over default SSH port number. Upon establishing connection, login credentials are substituted with the previously defined values: root/password (authentication modes are described in the User authentication modes section).

Prerequisites

Description below assumes that the system has been already initiated. The initiation procedure is described in the System initiation topic.

Configuration

Adding a Server

Server is a definition of the IT infrastructure resource, which can be accessed over one of the specified protocols.

1. Select Management > Servers.

2. Click + Add server.

3. Provide essential configuration parameters:

Parameter	Value
General
Name	ssh_server
Description
Blocked
Protocol	SSH
Legacy crypto
Bind address	Any
Permissions
Granted users
Destination
Address	192.168.0.100
Mask	32
Port	22
Server verification	None

4. In the Server verification section select Server public key and click Get public key or provide respective public key data.

5. Click Save.

Adding a User

User defines a subject entitled to connect to servers within monitored IT infrastructure. Detailed object definition (i.e. unique login and domain combination, full name, email address etc.) enables precise accountability of user actions when login and password are substituted with a shared account login credentials.

1. Select Management > Users.

2. Click Add.

3. Provide essential user information:

Parameter	Value
General
Name	john_smith
Role	user
Blocked
Account validity	Indefinite
Settings Tab
Safes
Authentication section
Authentication failures
Enforce password complexity
Add authentication method:	Static password
Password	john
User Data Tab
Fudo domain
AD Domain
LDAP Base
Full name	John Smith
Email	john@smith.com
Organization
Phone
Permissions Tab
Granted users

4. Click Save.

Adding a Listener

Listener determines server connection mode (proxy, gateway, transparent, bastion) as well as its specifics.

1. Select Management > Listeners.

2. Click Add.

3. Provide essential configuration parameters:

Parameter	Value
General
Name	ssh_listener
Blocked
Protocol	SSH
Legacy crypto
Case insensitivity
Permissions
Granted users
Connection
Mode	bastion
Local address	10.0.150.151
Port	22
External address
External port

4. Click i to generate the proxy server’s private key or i to upload the .PEM file private key definition.

Note

For security reasons the form displays server’s public key derived from the generated or uploaded private key.

5. Click Save.

Adding an Account

Account defines the privileged account existing on the monitored server. It specifies the actual login credentials, user authentication mode: anonymous (without user authentication), regular (with login credentials substitution) or forward (with login and password forwarding); password changing policy as well as the password changer itself.

1. Select Management > Accounts.

2. Click Add.

3. Provide essential configuration parameters:

Parameter	Value
General
Name	admin_ssh_server
Blocked
Account type	regular
Session recording	all
Notes
Data retention
Override global retention settings
Delete session data after	61 days
Permissions
Granted users
Server
Server	ssh_server
Credentials
Domain
Login	root
Replace secret with	with password
Password	password
Repeat password	password
Password change policy	Static, without restrictions

4. Click i to generate the proxy server’s private key or i to upload the .PEM file private key definition.

Note

For security reasons the form displays server’s public key derived from the generated or uploaded private key.

5. Click Save.

Defining a Safe

Safe directly regulates user access to monitored servers. It specifies available protocols’ features, policies and other details concerning users and servers relations.

1. Select Management > Safes.

2. Click Add.

3. Provide essential configuration parameters:

Parameter	Value
General
Name	ssh_safe
Notifications
Login reason
Require approval
Policies
Note access	No access
Protocol functionality
RDP
SSH
VNC

4. Select Users tab.

5. Click Add user.

6. Find John and click ..

7. Click OK.

8. Select Accounts tab.

9. Click Add account.

10. Find the admin_ssh_server object and click ..

11. Click OK.

12. Click in the Listeners column.

13. Find the ssh_listener object and click ..

14. Click OK.

15. Click Save.

Establishing Connection

PuTTY - SSH client for Microsoft Windows

1. Download and launch PuTTY.

2. In the Host Name (or IP address) field, enter 10.0.150.151.

3. Select the SSH connection type and leave the default port number unchanged.

4. Click Open.

5. Enter user name along with account login on the target server and target server address.

6. Enter password.

Command line interface

Launch terminal and run ssh command using following format:

ssh -l <fudo-user>#<server-user>#<server-address> <fudo-address>

Example:

ssh -l john_smith#root#192.168.0.110 10.0.150.151

Viewing User Session

1. Open a web browser and enter the Fudo Enterprise administrator panel IP address.

2. Enter the login and password to login to the Fudo Enterprise administration panel.

3. Select Management > Sessions.

4. Find John Smith’s session and click i.

Related Topics:

• Requirements

• Data model

• Quick start - RDP connection configuration

• Quick start - HTTP connection configuration

• Quick start - MySQL connection configuration

• Quick start - Telnet connection configuration