Enhancing Remote Access Security
Jump Box Security

While Linux can be made very secure, you can increase the security of your entire network with jump boxes.
Special Thanks: This article was made possible by support from Linux Professional Institute
A jump box is a system set up with multi-factor authentication (MFA) usually placed in a network DMZ with very restricted access to the corporate network and no returning Internet access for any protocol. In other words, the jump box has only one path in via SSH ,and no other protocols are allowed outbound to the Internet or into the corporate network. Figure 1 shows a simplified diagram of a jump box and where and how it is positioned within your network.
A secure jump box is an excellent out-of-band (OOB) remote access method for system administrators. It ensures that your network has 24x7x365 support and is a reasonable solution when some of your users either have no direct office or data center access.
Internet Access
The jump box should be set up with MFA, as should all systems attached to the corporate network. No user should be in the sudoers group or be allowed to become the root user on this system. When the jump box system requires maintenance, a system administrator should use a console login either via an onboard access controller or through a directly attached keyboard, video, and mouse (KVM) apparatus.
Since the jump box resides in the DMZ or another network that can be accessed via the Internet, great care should be taken to ensure its security by applying patches and updates as soon as they are made available. Additionally, the jump box shouldn’t host any protocols except for SSHD. The jump box has a single purpose as an SSH gateway into the corporate network. The only exception is for MFA purposes. Some MFA solutions require Internet access or at least some method of communicating with an authentication service inside the network. Time-based solutions are more secure, but any MFA solution is more secure than simple passwords alone.
MFA
It’s hard to stress the MFA requirement enough. No accounts on the jump box system should be accessible without using MFA unless it is a console login. The most secure type of MFA is to require that each user have a physical token such as a hardware token, which is a device that generates random numbers or alphanumeric sequences.
To use a hardware token, the user supplies a username, a passcode, and a random number or sequence from the token. The random number that is generated is usually only active for 60 seconds. This security principle is based on “something you know plus something you have” that a remote hacker couldn’t gain access to or spoof.
Additional Security
To further secure your jump servers, you should follow these suggestions:
- Disable or remove unnecessary protocols, daemons, and services.
- Never store SSH private keys on the jump server.
- Configure internal hosts with /etc/hosts.allow and /etc/hosts.deny files to control access.
- Create at least one secondary /backup jump box in case of failure.
- Use a restrictive, host-based firewall for all Linux systems.
- Set up a service such as Fail2Ban to resist brute-force attacks.
- Install a minimal distribution option.
- Set up NAT forwarding to your jump box.
Remember that there’s no such thing as too much security when it comes to protecting your data, your customer base, and your intellectual property. Internet-accessible systems will come under attack; they need to be secure, and convenience should never be a factor in selecting security measures.
Some network administrators also place a firewall between the Internet and the DMZ and use NAT port forwarding for all services. Leaving systems wide open on all protocols is not a good practice. It makes more sense to secure the DMZ by limiting the incoming and outgoing protocols from that network.
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
News
-
elementary OS 7.1 is Now Available for Download
The team behind elementary OS has released the latest version of its operating system with a focus on personalization, inclusivity, accessibility, and privacy.
-
The GNU Project Celebrates Its 40th Birthday
September 27 marks the 40th anniversary of the GNU Project, and it was celebrated with a hacker meeting in Biel/Bienne, Switzerland.
-
Linux Kernel Reducing Long-Term Support
LTS support for the Linux kernel is about to undergo some serious changes that will have a considerable impact on the future.
-
Fedora 39 Beta Now Available for Testing
For fans and users of Fedora Linux, the first beta of release 39 is now available, which is a minor upgrade but does include GNOME 45.
-
Fedora Linux 40 to Drop X11 for KDE Plasma
When Fedora 40 arrives in 2024, there will be a few big changes coming, especially for the KDE Plasma option.
-
Real-Time Ubuntu Available in AWS Marketplace
Anyone looking for a Linux distribution for real-time processing could do a whole lot worse than Real-Time Ubuntu.
-
KSMBD Finally Reaches a Stable State
For those who've been looking forward to the first release of KSMBD, after two years it's no longer considered experimental.
-
Nitrux 3.0.0 Has Been Released
The latest version of Nitrux brings plenty of innovation and fresh apps to the table.
-
Linux From Scratch 12.0 Now Available
If you're looking to roll your own Linux distribution, the latest version of Linux From Scratch is now available with plenty of updates.
-
Linux Kernel 6.5 Has Been Released
The newest Linux kernel, version 6.5, now includes initial support for two very exciting features.