4

I have set up a bastion server (A) that acts as the only "hallway" to enter a bunch of other private VPS's (B). That is to say: the private machines only accept SSH-connections from (A) on a non-standard port, which is a hard firewall rule, and only accept these connections from (A) using a specific user and a specific key.

I was wondering which strategy I should use for emergencies where for instance the bastion (A) goes down, gets compromised or in somehow gets useless. It would make my private VPS's (B) inaccessible for ever.

Should I allow for the (B) machines to be accessed through another IP address than the bastion (A) as well? I don't have the infrastructure to allocate whole IP blocks, so permissions based on ranges won't work for me.

Any thoughts?

  • 1
    This isn't a security question. Why not simply replace/rebuild A when it goes down? Why not access the VPS's through their control panel? There appear to be a bunch of factors that you have not disclosed. – schroeder Apr 23 '17 at 14:30
  • I seriously hope control panels don't override firewall rules and PasswordAuthentication no... – Hirohito Apr 23 '17 at 14:34
  • if they log in locally, they sure do – schroeder Apr 23 '17 at 14:36
5

This is just an expansion of what @schroeder said in the comments. You can access (A) or any of (B)'s without SSH if you are using a decent provider.

Most VPS services allow a console login. The console login is not performed through ssh but through a getty (or agetty, mgetty or other variant) process talking to the virtualisation supervisor.

As an example that I often use (and so do most VPS services), the KVM virt-manager has a virsh console command. Then the VPS provider only needs to pipe input and output of that process into the web/app console. The

PasswordAuthentication no

in /etc/ssh/sshd_config is never used by that method since the sshd process is not being touched.

As for the security considerations of this method, they're in your VPS provider court. Most providers provide a pretty decent set of checks before you can login into the console (linode, digital ocean and AWS are three that I did use the console and I could configure dual factor auth). That said, this is simply analogous to going into a server room and connecting a physical console to the console port of your machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.