Hacker News new | ask | show | jobs
by gkrishna 1587 days ago
I find this very useful. I will setup a bastion. Thank you
2 comments

I have a BuyVM.net 3.50/mo KVM slice that has been idling for maybe a year (yeah I know I need to get on it..), so I can transfer that to you if you want. BuyVM has been around forever and they are awesome, but are almost always sold out (just checked and they are).

If you want to reply with your contact details I can see if I can get that going and you can take over the vps if you want..

Other options for providers:

- netcup.eu (I use them.. they don’t have small instances but they are super great prices for the sizes they offer)

- Hetzner Cloud (never used but heard great things and their prices are very low)

- OVHCloud (I have dedi servers from Kimsufi and SoYouStart which have been great— OVH is the parent company)

- prgmr.com - these guys have been around since the very beginning of vps hosting. They wrote the book (quite literally) on Xen ( https://www.amazon.com/Book-Xen-Practical-System-Administrat... )

- low $ NAT VPS options:

https://clients.inceptionhosting.com/cart.php?gid=13

https://hosting.gullo.me/pricing

- free ipv6-only vps (or $1/mo to add an ipv4):

https://www.euserv.com/en/virtual-private-server/root-vserve...

- An informative resource: https://lowendbox.com/blog/free-vps-providers/

On your ssh bastion make sure to at the very least:

- have minimal services running, preferably only ssh

- if you have other services running then use iptables or a firewall frontend to block all incoming ports except for the ones you specifically need/want open

- disable root ssh login

- disable password login (eg use ssh keys and preferably with a passphrase too)

- you can also use something like fail2ban or denyhosts but it’s not really necessary if you’ve also done all the above

- yum or apt update it frequently

- For your ssh connection from the bastion to your AWS instance or any other important ssh destinations from the bastion, use a key with a passphrase for increased security (on the off chance your bastion gets compromised)

- Don’t do anything else too important on your ssh bastion.. eg don’t have any important stuff or work laying around on it or other services/applications running. Just use it as a jumphost only.

is there any way to just tunnel the ssh traffic trough the bastion but let the ssh authentication be done from my computer instead?

that way i would not need to keep the keys in the bastion server at all.

Yes, it’s fairly trivial with ProxyCommand or ProxyJump switch:

https://www.redhat.com/sysadmin/ssh-proxy-bastion-proxyjump