Securely report SSH classes on RHEL in a non-public VPC community

On this weblog publish, you’ll learn to report SSH classes on a Pink Hat Endeavor Linux (RHEL) VSI in a non-public VPC community the usage of inbuilt programs. The VPC inner most community is provisioned thru Terraform and the RHEL programs are put in the usage of Ansible automation. Moreover, you’ll learn to arrange a extremely to be had bastion host.

What’s consultation recording and why is it required?

A bastion host and a bounce server are each safety mechanisms utilized in community and server environments to keep an eye on and fortify safety when connecting to far flung methods. They serve an identical functions however have some variations of their implementation and use instances. The bastion host is positioned in entrance of the non-public community to take SSH requests from public visitors and cross the request to the downstream system. Bastion host and bounce servers are liable to intrusion as a result of they’re uncovered to public visitors.

Consultation recording is helping an administrator of a gadget to audit consumer SSH classes and ensure they agree to regulatory necessities. Within the tournament of a safety breach, the administrator will need to audit and analyze the consumer classes. That is crucial for a security-sensitive gadget.

What’s a non-public VPC community?

A digital inner most cloud is totally inner most if there is not any public ingress or outgress community visitors. In easy technical phrases, it’s inner most if there aren’t any public gateways at the subnets (inner most subnets) and no floating IPs at the Digital Server Circumstances (VSIs).

How do I hook up with the non-public VPC community?

Shopper-to-site VPN for VPC is without doubt one of the two VPN choices to be had on IBM Cloud, and it lets in customers to hook up with IBM Cloud sources thru safe, encrypted connections.

The buyer-to-site VPN is very to be had, with two VPN servers which might be created in two other availability zones in the similar area. The bastions are extremely to be had as neatly.

Necessities

Provision the non-public VPC community the usage of Terraform

• After you have the IBM Cloud Secrets and techniques Supervisor secret with the certificates, release your terminal and set the next Terraform variables:

export TF_VAR_ibmcloud_api_key=<IBM_CLOUD_API_KEY>

export TF_VAR_secrets_manager_certificate_crn=<SECRET_CRN>

git clone https://github.com/VidyasagarMSC/private-vpc-network

cd terraform

• Run the Terraform instructions to provision the VPC sources (e.g., subnets, bastion hosts (VSIs), VPN, and so forth.):

terraform init

terraform plan

terraform follow

Hook up with client-to-site VPN

• As soon as the VPC sources are effectively provisioned, you want to obtain the VPN Jstomer profile by way of navigating to VPN servers web page on IBM Cloud.
• Click on the Shopper-to-site servers tab after which at the title of the VPN:

• Obtain the profile from the Purchasers tab.
• The VPN provisioned thru Terraform makes use of certificate. Practice the directions right here to hook up with the OpenVPN Shopper.
• You will have to see the a success connection to your OpenVPN Shopper:

Test the SSH connection

• On a terminal, upload the SSH inner most key to the SSH agent with the next command:

ssh-add <LOCATION_OF_PRIVATE_SSH_KEY> 

• Instance: ssh-add ~/.ssh/<NAME_OF_THE_PRIVATE_KEY>
• Run the next command to SSH into the RHEL VSI thru a bastion host. You’re going to be the usage of the non-public IP cope with of the bastion in Zone 1:

ssh -J root@10.10.0.13 root@10.10.128.13

• Be mindful, you will have to be hooked up to the client-to-site VPN to get right of entry to the RHEL VSI in the course of the bastion host.
• After SSH, You will have to see directions to allow SSH consultation recording the usage of the TLOG bundle on RHEL.

Deploy consultation recording the usage of Ansible

To deploy the consultation recording resolution, you want to have the next programs put in at the RHEL VSI:

• tlog
• SSSD
• cockpit-session-recording

The programs will likely be put in thru Ansible automation on the entire VSIs—each bastion hosts and RHEL VSI.

• Transfer to the Ansible folder:

cd ansible

• Create hosts.ini from the template report:

cp hosts_template.ini hosts.ini

• Run the Ansible playbook to put in the programs from an IBM Cloud inner most replicate/repository:

ansible-playbook main_playbook.yml -i hosts.ini --flush-cache

You’ll be able to see in Determine 1 that when you SSH into the RHEL system, you are going to see a observe announcing: ATTENTION! Your consultation is being recorded!

Test the consultation recordings, logs and experiences

For those who intently practice the messages post-SSH, you are going to see a URL to the internet console that may be accessed the usage of the system title or inner most IP over port 9090. To permit visitors on port 9090, within the Terraform code, alternate the worth of allow_port_9090 variable to true and run terraform follow. The most recent terraform follow will upload ACL and safety staff laws to permit visitors on port 9090.

• Now, open a browser and navigate to http://10.10.128.13:9090. To get right of entry to the usage of the VSI title, you want to arrange a non-public DNS (out of scope for this text). You want a root password to get right of entry to the internet console:

• Navigate to Consultation Recording at the left-hand facet to look the record of consultation recordings. Along side consultation recordings, you’ll be able to test the logs, diagnostic experiences, and so forth.:

Really useful studying

Conclusion

This newsletter lined why consultation recording is needed in bastion hosts for auditing and compliance and the way consultation recording may also be arrange with the integrated RHEL programs the usage of Ansible Automation.

Whilst designing a secured digital inner most cloud community, you discovered the most efficient practices in architecting a VPC inner most community. We additionally lined the want to construct extremely to be had VPN servers and bastion hosts. With the provisioning of cloud infrastructure the usage of Terraform and Ansible for consultation recording, you were given hands-on enjoy.

Be informed extra about IBM Cloud VPC

When you have any queries, be happy to achieve out to me on Twitter or on LinkedIn.