4 ms·

> I'm also not sure of the rationale for having a bastion host It's a central place where you can do your logging, which many enterprises must do for complianc

• pm90 8y ago
  Really? Do any compliance standards specifically require this? Or is the specific control defined in the organization itself that requires this? I've found many compliance standards to be pretty open-ended and function-driven, rather than prescribing specific standards. Client contracts.... they may be a different beast, and often require specific promises by vendors.
  • dvtrn 8y ago
    PCI-DSS comes to mind and it’s segmentation guideline, often met by deploying bastions.
  • perlgeek 8y ago
    I'm pretty sure that at least some of the German financial regulations require that you can audit administrative actions on systems that are relevant for the financial transactions. Now, you could try to implement that on the systems themselves, but how do you establish a mechanism that logs actions of an administrative user, and at the same time cannot be disabled by the same administrative user? So instead you use a shell control box as a bastion, and regular administration of the target hosts don't have root access to the shell control box, so they cannot circumvent logging. I haven't yet any standards that explicitly demand bastions, but it seems to be one of the standard implementations that have proven to pass audits, and so it's a pretty low-risk implementation of the logging requirements.