7.4. Bastion

7.4.1. Bastion Rules

Bastion Rules control access for suSSHi Proxy bastion mode sessions. When a gateway user connects to a suSSHi Proxy using the bastion syntax (<gateway_user>@<proxy_realm>), the gateway evaluates the Bastion Rules to determine whether the session is permitted and which Bastion Profile to apply.

Each Bastion Rule combines:

  • Gateway Users — the gateway users the rule applies to.

  • Source IPs — the source IP addresses or ranges from which the connection must originate.

  • Proxies — the proxy realms for which the rule is valid.

  • Bastion Profile — the profile defining session limits, logging, and port-forwarding permissions. Set to DENY to explicitly block matching connections.

The ruleset is evaluated from top to bottom and the first matching rule is applied.

7.4.1.1. Adding a Bastion Rule

By default, a new rule is created at the end of the ruleset. A different insertion position can be selected via the position drop-down when creating the rule.

7.4.1.2. Moving a Bastion Rule

There are three ways to reorder rules within the ruleset:

  1. Drag-and-drop — grab the rule in the left area and move it up or down.

  2. “Move policy rule” action — click the action and select the new position from the drop-down.

  3. “Edit” action — use the Position drop-down when editing the rule.

7.4.1.3. Removing a Bastion Rule

A rule can be removed by clicking the trash can button and confirming the deletion.

7.4.1.4. Usage Statistics

Each Bastion Rule tracks the number of times it has been matched (Use Count), along with the time of first and last use. This information can be used to identify unused or rarely used rules.

7.4.2. Bastion Profiles

Bastion Profiles define the session settings applied when a gateway user connects via a suSSHi Proxy in bastion mode. They are assigned to Bastion Rules and control session limits, logging, and port-forwarding permissions for those sessions.

Max Session Time

The maximum duration a bastion session can run regardless of activity. After this time, the session is terminated. Valid range: 60–31622400 seconds. Leave empty for unlimited session time.

Max Idle Time

The maximum time a bastion session can remain inactive. If no input or output occurs within this period, the session is terminated. Valid range: 60–31622400 seconds, and must not exceed Max Session Time. Leave empty for unlimited idle time.

Client Authentication Set

Specifies which client authentication methods are accepted for this bastion session. Defaults to the partition default client authentication set.

Logging Mask

Determines how detailed the recording of the bastion session should be.

Audit Log Encryption

When enabled, suSSHi Gateway encrypts all audit log files produced for sessions governed by this profile. Only administrators with an ED25519 public key configured in suSSHi Chef can decrypt the resulting files. Refer to the Administration Users section for key management and to Logging for details on the encryption mechanism.

This option is only shown when at least one administrator account has an audit log encryption key configured.

Allow SSH via TCP Forwarding

Controls whether further SSH sessions initiated through a forwarded TCP port are permitted.

Local Forwards

Controls which local port forwards (-L in OpenSSH) are permitted within the bastion session.

Format: IPv4:Port, [IPv6]:Port, or Hostname:Port. Asterisk (*) is supported for host and port. localhost can be used as shorthand for three rules matching localhost, 127.0.0.1 and ::1.

Remote Forwards

Controls which remote port forwards (-R in OpenSSH) are permitted within the bastion session.

Format: localhost:Port, IPv4_bindaddress:Port, or [IPv6_bindaddress]:Port. Asterisk (*) is supported for host and port.