#bastion (2019-04)

@Paul Calabro has joined the channel

so erik, what are your thoughts on that?

(from the other channel)

https://sweetops.slack.com/archives/CB3579ZM3/p1554233634025100

So this would be a problem if the person’s workstation were compromised, no?

correct

with those kinds of settings in place, 2FA is only prompted on the first attempt

i was trying to think of an fun analogy and the best i could come up with is someone using a door wedge, haha

True it is like a door wedge

But the same thing exists with ssh agents

And sockets

I am not averse to adding support to optionally disabling these settings

Not sure what the default should be

Often times, if the bad actor has control of the workstation all bets are off

yeah, those are all good points. i think the bastion is a little unique though in that you’re not just using your keys you’ve already added to the ssh agent. you’re also using push notification/sms/etc as that second factor…however, those gets bypass completely in this scenario.

Yea true

What if we had some SSH server config profiles? E.g. configs with an extension

When starting the container we install one of those config profiles

yeah, i was thinking of that as well. i use configs in my docker compose file to mount files.

One profile could be the one you suggest and maybe we make that default

that works

If you want to open a PR for that we will promptly review

i came across this accidentally and just thought i’d share b/c it seems like an interesting way to misuse an ssh feature

sweet! thanks!

Yea makes sense

It’s a very popular repo and #1 search result

So we should make it as locked down as possible

yeah, i’m a fan of this project

Very cool!

it’s good stuff!

If you have a chance to audit our scripts in that project, that would be appreciated as well

yeah, i’d be happy to take a look

@Bruce has joined the channel

@mahmoudamindolah has joined the channel

@Vidhi Virmani has joined the channel

@kskewes has joined the channel

@rontron has joined the channel

@oscarsullivan_old has joined the channel

Do you install Bastion on to every machine or just your one jump host that connects to your internal machines on private subnets?

bastion is a jump host

Thanks that’s what I thoght

here’s an updated readme PR @Erik Osterman (Cloud Posse) https://github.com/cloudposse/bastion/pull/43

( I am out of town, will check on Monday! Thanks @oscarsullivan_old )

@joshmyers has joined the channel

@mohamed.naseer has joined the channel