Bastion host

A bastion host is a special purpose computer on a network specifically designed and configured to withstand attacks. The computer generally hosts a single application, for example a proxy server, and all other services are removed or limited to reduce the threat to the computer. It is hardened in this manner primarily due to its location and purpose, which is either on the outside of a firewall or in a demilitarized zone (DMZ) and usually involves access from untrusted networks or computers.

Background

The term is generally attributed to Marcus J. Ranum in an article discussing firewalls. In it he defines bastion hosts as

...a system identified by the firewall administrator as a critical strong point in the network security. Generally, bastion hosts will have some degree of extra attention paid to their security, may undergo regular audits, and may have modified software.^[1]

Definition

It is a system identified by firewall administrator as critical strong point in network security. A bastion host is a computer that is fully exposed to attack. The system is on the public side of the DMZ, unprotected by a firewall or filtering router. Frequently the roles of these systems are critical to the network security system. Indeed, the firewalls and routers can be considered bastion hosts. Due to their exposure, a great deal of effort is made to minimize the chances of penetration. Other types of bastion hosts include web, mail, DNS, and FTP servers.^[2]

Placement

There are two common network configurations that include bastion hosts and their placement. The first requires two firewalls, with bastion hosts sitting between the first "outside world" firewall, and an inside firewall, in a DMZ. Often smaller networks do not have multiple firewalls, so if only one firewall exists in a network, bastion hosts are commonly placed outside the firewall.^[3]

Bastion hosts are related to multi-homed hosts and screened hosts. While a dual-homed host often contains a firewall it is also used to host other services as well. A screened host is a dual-homed host that is dedicated to running the firewall. A bastion server can also be set up using ProxyCommand with OpenSSH.^[4]

Examples

These are several examples of bastion host systems/services:

• DNS (Domain Name System) server
• Email server
• FTP (File Transfer Protocol) server
• Honeypot
• Proxy server
• VPN (Virtual Private Network) server
• Web server

Best practices

Because bastion hosts are particularly vulnerable to attack, due to the level of required access with the outside world to make them useful, there are several best practice suggestions to follow:

• Disable or remove any unneeded services or daemons on the host.
• Disable or remove any unneeded user accounts.
• Disable or remove any unneeded network protocols.
• Configure logging and check the logs for any possible attacks.
• Run an intrusion detection system on the host.
• Patching the operating system with the latest security updates.
• Lock down user accounts as much as possible, especially root or administrator accounts.
• Close all ports that are not needed or not used.
• Use encryption and multi-factor authentication for logging into the server.

See also

• Demilitarized zone
• Firewall (computing)
• Hardening (computing)
• Jump server
• Proxy server

References