Bastionhost

alibabacloud Bastion hostalibaba-bastionhost

Audited jump host that brokers SSH and RDP sessions, records them as video and commands, and blocks high-risk commands.

Provider: alibabacloud
Kind: Bastion host
Category: Security
Official docs: https://www.alibabacloud.com/help/en/bh/bastionhost/user-guide/o-and-m-auditing/

Properties · 3 set by this component

property	type	values	required	kind default	this component
centralAccountManagement · component property	boolean	—	no	true	inherited
commandBlocking · component property	boolean	—	no	true	inherited
justInTimeAccess	boolean	—	no	false	inherited
managed	boolean	—	no	false	▸ true
mfaRequired	boolean	—	no	—	inherited
protocols	enum	ssh \| rdp \| both	no	—	▸ both
publicIp	boolean	—	no	—	inherited
realTimeSessionMonitoring · component property	boolean	—	no	true	inherited
sessionRecording	boolean	—	no	—	▸ true

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "bastionhost", component: "alibaba-bastionhost" }

Other Bastion host products · 17

EC2 Instance Connect Endpointaws-ec2-instance-connect-endpointawsbastion-host AWS Systems Manager Session Manageraws-ssm-session-managerawsbastion-host AWS Verified Accessaws-verified-accessawsbastion-host Azure Bastionazure-bastionazurebastion-host Microsoft Entra Private Accessazure-entra-private-accessazurebastion-host Cloudflare Accesscloudflare-accesscloudflarebastion-host Cloudflare One RDPcloudflare-rdpcloudflarebastion-host Generic bastion hostbastion-hostbastion-host HashiCorp Boundaryboundarybastion-host ContainerSSHcontainersshbastion-host Paralusparalusbastion-host Pomeriumpomeriumbastion-host OpenSSH jump hostssh-jump-hostbastion-host Teleportteleportbastion-host Chrome Enterprise Premiumgoogle-chrome-enterprise-premiumgcpbastion-host Identity-Aware Proxygoogle-identity-aware-proxygcpbastion-host Bastionoci-bastionocibastion-host

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Bastionhost: the audited jump host for operations and maintenance access. The Bastionhost
3# documentation describes an O&M audit system that manages multiple accounts centrally and provides
4# single sign-on to backend server resources, states that O&M sessions are SSH- and RDP-based remote
5# connections, that Bastionhost records asset O&M sessions including session videos and commands and
6# can replay them, that auditors can monitor SSH and RDP sessions in real time and interrupt high-risk
7# sessions, and that high-risk commands are blocked in real time. No default for multi-factor
8# authentication or a public endpoint is stated, so neither is set here.
9schemaVersion: "1"
10type: "component"
11id: "alibaba-bastionhost"
12kind: "bastion-host"
13provider: "alibabacloud"
14docs: "https://www.alibabacloud.com/help/en/bh/bastionhost/user-guide/o-and-m-auditing/"
15defaults:
16  managed: true
17  protocols: "both"
18  sessionRecording: true
19properties:
20  commandBlocking:
21    type: "boolean"
22    default: true
23  realTimeSessionMonitoring:
24    type: "boolean"
25    default: true
26  centralAccountManagement:
27    type: "boolean"
28    default: true

The same page as markdown, for an agent: /catalogue/components/alibaba-bastionhost.md