3 ms·
One option could be to lock the port down to only your jump/bastion server source IP.
by indigodaddy 3y ago
One option could be to lock the port down to only your jump/bastion server source IP.
- bradknowles 3y agoThat fails to when you lose that IP address, or you lose that server.
- indigodaddy 3y agoI suppose if you don’t have console access, sure. But inconvenient at worst imv.
- bradknowles 3y agoIf you have a way around that bastion server, then at least you've got a backup. But then you also have to worry about the security of that backup.
- PLG88 3y agoYes, better to make your bastion 'dark' without being tied to an IP address. This is how we do it at my company with the open source tech we have developed - https://netfoundry.io/bastion-dark-mode/ https://netfoundry.io/bastion-dark-mode/