Enhancing Remote Access Security

VMs as Jump Boxes

Administrators prefer to use virtual machines (VMs) as jump boxes, because of their low cost, ease of deployment, and ease of maintenance. Virtualization makes creating such services almost trivial. If your team already has a security VM template created, deploying a new jump box only takes a few minutes. Further configuration and setup that is jump box specific will be far less of a hassle if an administrator can deploy a system, set the appropriate VLAN ID, create user accounts, set up MFA, and allow users to connect within a few hours of initial deployment.

A quick Internet search for “jump box” yields quite a few results for deploying jump boxes for Amazon Web Service (AWS) environments. Some of these even outline best practices and caveats for secure setups for AWS.

An additional layer of security is to limit the amount of time the jump box is available for use. For example, if your entire staff is local, then you can restrict access until after regular business hours for a limited window for maintenance. This restriction can be pushed even further by only allowing access during maintenance events rather than every day from 6PM to 7AM.

Summary

A jump box’s sole purpose is provide an SSH gateway into your internal network for administrators, and it should be made as secure as possible. MFA greatly increases security for all systems, not just jump boxes. It’s an added pain for administrators, but the added security layer is worth the few extra seconds required to work with an MFA solution.

Even the largest enterprises use jump boxes and other OOB network access protocols, so there are resources available to help you work through any security issues or configurations. Jump box deployment requires careful planning and close adherence to security best practices for firewalls, operating systems, networks, and users.

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Enhanced Security

    Verifying the security of your SSH configuration and performing regular audits are critical practices in maintaining a secure Linux environment.

  • Securing Your Systems

    We'll show you how the lessons learned in the 1980s movie "The Karate Kid" can be applied to securing your systems.

  • Multifactor Authentication with SSH

    The Google Authenticator PAM module allows you to use time-based Google Authenticator passwords with various Linux services, including SSH.

  • Getting to Know Firewalld

    Managing a firewall can be a hassle, but it’s worse to manage a breach because you didn’t have one.

  • KSplice

    Uptime is often just as important as updates. But doesn't a kernel patch require a reboot? Ksplice lets you have your cake and eat it too.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News