7.3. Usage

Targets that can be reached via a suSSHi Proxy are configured with a reference to the proxy so that they are valid in the namespace of this proxy. Two identical targets (e.g. with the same IP or DNS hostname) referenced to different proxies are thus in different namespaces and can be neatly distinguished.

Note

If you are familiar with the concept of VRFs in networking, you can think of the targets as being contained in a VRF that is referenced by the proxy. The regular targets can then be referred to as being contained in the default VRF.

Each target referenced with a proxy is unique to this proxy and can be used in the access rules by just selecting the target as with regular targets. The targets configured with a reference to a proxy are displayed in the access rules and all other lists accordingly in the form of <target>@<proxy_realm>. This is exactly how they are addressed by the user connecting to these targets.

So instead of the well-known form of <gateway_user>@<target_user>@<target>, the SSH user will be in the form of <gateway_user>@<target_user>@<target>@<proxy_realm>.

Example:

$ ssh johndoe@root@target@abc@susshi.example.org
$ ssh -l johndoe@root@target@abc susshi.example.org

7.3.1. Bastion Mode

In bastion mode, a suSSHi Proxy acts as an SSH endpoint for users who require direct interactive access to a host within the protected environment — without specifying a separate target. This is useful when administrators need a shell on the proxy host itself or when the proxy acts as a jump host.

To start a bastion session, the user connects to the suSSHi Gateway using the proxy realm as the target, omitting any target user and target:

$ ssh johndoe@<proxy_realm>@susshi.example.org

Access to bastion sessions is governed by Bastion Rules configured in suSSHi Chef. Each Bastion Rule defines which gateway users may connect via which proxy realms from which source IP addresses, and assigns a Bastion Profile that controls session limits, logging, and port-forwarding permissions.