Disclaimer I helped design the bastion-zero protocol. Sorry for the wall of text, I just care a lot about this protocol and I think it is really neat so I'm alw

Disclaimer I helped design the bastion-zero protocol. Sorry for the wall of text, I just care a lot about this protocol and I think it is really neat so I'm always excited to talk about it. > But it obviously doesn’t go down to the app level, which is what the original government document is actually saying we should do. Bastion-zero does go down to the app level. Bastion Zero lets you log into roles in applications not mere hosts or ports. This is one of the big advantages of bastion-zero over say tailscale or segmented VPNs. With kube, bastion-zero you could enforce a policy that a particular user identity, say "Alice@example.com", can only access the control plane of certain kube clusters with the kube role 'dev-user'. Not only is this policy enforced at the application and role level but logs are application and identity aware as well. Look at an example of using bastion-zero for shell access. Alice's gsuite identity is Alice@example.com and lets say she has a policy in bastion-zero which allows her to login to the linux shell as 'qa-user' on the host 'qa-dev-123'. Without bastion-zero logs on 'qa-dev-123' would only capture the 'qa-user' performed some action so: 1. Application role: 'qa-user', 2. hostname: 'qa-dev-123', 3. Action: 'rm -rf /' That isn't helpful if multiple people can sign in as 'qa-user'. Additionally since the logs are stored on the host, an attacker might be able to delete or tamper with them after the fact. With bastion-zero, the bastion captures the logs off-the-wire preventing tampering and it associates each action Alice takes with: 1. OpenID Connect auth session: 'a specific authorization token issued by gsuite and associated with a particular machine', 2. Alice's OpenID Connect identity: 'Alice@example.com', 3. Application role: 'qa-user', 4. hostname: 'qa-dev-123', 5. cryptographic identity of host: 'pubkey:0x4e32...' 6. Action: 'rm -rf /' This way we can tell, oh Alice's OpenID Connect identity token has been compromised on her laptop. Revoke that token. What other actions where taken under that token? Did the attacker successfully answer an MFA challenge from the Bastion? Yes? we know Alice's MFA secret has been compromised. Our goal with basiton-zero: * all parties have pubkeys which are strongly bound to their identity forever, but only usable over short periods of time * all pubkeys are short lived and ephemeral you are expected to generate new ones, you don't need to remember old ones * all the content of all messages is digitally signed by public keys producing logs which can be cryptographically attributed * no single points of trust or compromise * policy and logging are identity and application aware