What does bastionhost do, and the basic functions of bastionhost

In a specific network environment, in order to protect the network and data from intrusion and damage from external and internal users, bastionhost uses various technical means to collect and monitor the system status, security events, and network activities of each component of the network environment in real time, so as to provide centralized alarms, timely processing, and audit and responsibility.

Also known as O&M security audit system, bastion hosts mainly include system O&M and security audit.

Differences between firewalls and bastion hosts

The firewall is the gatekeeper between the VPC and the Internet, while the bastion host is the gatekeeper between the internal O&M personnel and the private network.

Different defensive roles: The role of the firewall is to cut off, no matter who can not get through, but bastion host is different, its function is to check and judge whether it can pass, as long as it meets the conditions, it can pass, it is a strengthened system that can actively defend against attack.

The difference between a jump starter and a bastionhost

Different login methods: The jump server belongs to the category of internal control bastion host, which is a host application system used for single sign-on. The jump server is a server, and the maintenance personnel must first log in to this server in the maintenance process, and then log in to the target device from this server for maintenance.

Different monitoring behaviors: The jump server does not control and audit the operation behavior of operation and maintenance personnel, and there will still be operation accidents caused by misoperation and illegal operation in the process of using the jump server, and it is difficult to quickly locate the cause and responsible person once an operation accident occurs, while the core of bastion host is controllable and auditable, and you can use bastion host to monitor the operation behavior of operation and maintenance personnel on resources (hosts, network equipment, databases, and security devices), so as to provide centralized alarms, timely processing, and audit and responsibility.

The basic functions of Bastionhost include single sign-on, account management, account authentication, resource authorization, access management, and O&M auditing.

Device resource management, blacklist and whitelist, resource authorization management, device account management, single sign-on, O&M access and auditing, these are large modules, and there are many subdivided small functions under each large module, such as actual monitoring, playback, and so on. The specific details need to be realized after you use it. Shangwei's functions are relatively complete, and its product forms are also more, which is worth recommending.

The role of Bastionhost is to control the fine-grained access of O&M personnel, control the O&M process step by step, and conduct all-round operation audits, so as to achieve "pre-prevention, in-process control, and post-audit" in the O&M process.

Bastionhost can protect and prevent internal and external damage in a designated network, so that important data and networks can run in a secure environment. Bastionhost has the function of cutting off the terminal computer to directly browse network and server resources.

At that time, there was an operation and maintenance personnel who had to assign accounts to hundreds or thousands of people at the same time, and if one of the accounts encountered problems or did anything to the system, it could not be traced.

Bastionhost is an O&M management and auditing system that uses various technical means to monitor and record the operations of O&M personnel on servers, system operations, security devices, databases, and other behaviors in the network to ensure the security of the network and data from intrusion and operation damage from external and internal personnel, and timely process and audit responsibility.

The so-called network security bastionhost is to add a security protection gate to the network, which can only pass through if the conditions are met, and if there are attacks and illegal commands, it cannot be entered, and all illegal access behaviors of the target are audited and monitored.

Bastionhost, also known as the O&M security audit system, has 4A:

Authentication authentication

Manage your account

Authorization control

Security audit

To summarize briefly, Bastionhost is used to control who can log in to which assets (precaution in advance and control during the event), and to record what is done after logging in to the assets (trace back to the source). ）。

Bastionhosts are divided into commercial bastionhosts and open source bastion, and open source software will undoubtedly be the mainstream in the future. JumpServer is the world's first fully open-source bastion host, a professional O&M audit system that complies with 4A, and has more than 10,000 GitHub stars.

In a specific network environment, in order to protect the network and data from intrusion and damage from external and internal users, Bastionhost uses various technical means to monitor and record the operation and maintenance personnel of servers, network devices, security devices, databases, and other devices in the network, so as to provide centralized alarms, timely processing, and audit and determine responsibility.

What does Bastionhost do?

1. From the perspective of the enterprise: Through the fine-grained security management and control strategy, the security of the enterprise's servers, network equipment, databases, and security devices is ensured, and the reliable operation of bastion hosts is used to reduce human security losses and ensure the benefits of the enterprise.

2. From the administrator's perspective: All operation and maintenance accounts are managed on one platform, which is more simple and orderly to ensure that the authority that users have is the minimum required to complete the task.

3. From the perspective of ordinary users: O&M personnel only need to remember one account and password, log in once, and can access multiple devices, reducing work complexity and providing work efficiency.

What are the main functions of Bastionhost?

Account management: The device supports a unified account management policy, which can centrally manage all servers, network devices, security devices and other accounts, complete the monitoring of the entire life cycle of the account, and set up special roles for the device, such as audit inspectors, transportation operators, equipment administrators, etc.

Identity authentication: The device provides a unified authentication interface to authenticate users, supports identity authentication modes including dynamic passwords, static passwords, hardware keys, biometrics and other authentication methods, and the device has flexible customized interfaces, which can be combined with other third-party authentication servers; The secure authentication mode effectively improves the security and reliability of authentication.

Resource authorization: The device provides fine-grained operation authorization based on factors such as user, target device, time, protocol type, IP, and behavior, to protect the security of user resources to the greatest extent.

In order to protect the network and data from intrusion and damage from external and internal users, bastion hosts use various technical means to collect and monitor the system status, security events, and network activities of each component of the network environment in real time, so as to provide centralized alarms, timely processing, and audit and responsibility. In fact, this role is still very crucial, and it is very worth having for companies with a certain scale.

To ensure data security, all platforms have single sign-on, the same O&M entrance, and unified asset management. You say it's worth it or not.

Bastionhost is a server that uses various technical means to collect and monitor the system status, security events, and network activities of each component of the network environment in real time in order to protect the network and data from intrusion and damage from external and internal users in a specific network environment, so as to provide centralized alarms, timely processing, and audit and responsibility.

As an indispensable part of enterprise information security construction, security audit has gradually attracted the attention of users and is an important part of the enterprise security system. Bastionhost can not only clarify the access path of each O&M personnel, but also make each access process auditable and traceable back to the source if a problem occurs.

With the continuous development of IT systems in enterprises and institutions, the network scale and the number of devices are rapidly expanding, and the increasingly complex IT systems and the behavior of operation and maintenance personnel with different backgrounds bring great risks to the security of information systems.

1. Multiple users use the same account. This situation mainly occurs in the same workgroup, due to the needs of the work, and the system manages the account at the same time, so only multiple users can share the same account. In the event of a security incident, it is not only difficult to locate the actual user and responsible person of the account, but also unable to effectively control the scope of use of the account, resulting in greater security risks and hidden dangers.

2. One user uses multiple accounts. It is common for a maintenance worker to use multiple accounts, and users need to memorize multiple sets of passwords to switch between multiple host systems and network devices at the same time, reducing work efficiency and increasing work complexity.

1. Enterprise perspective. Through fine-grained security management and control policies, it ensures the safe and reliable operation of the enterprise's servers, network equipment, databases, and security equipment, reduces human security losses, and ensures the benefits of the enterprise.

2. From the perspective of administrators. All operations are managed on a single platform, which is easier and more orderly to manage, ensuring that users have the least amount of permissions required to complete the task.

3. Permissions. Intuitive and convenient monitoring of various access behaviors, which can timely detect illegal operations and permission abuse.

4. From the perspective of ordinary users. O&M personnel only need to remember one and password, log in once, and then they can access multiple devices, reducing work complexity and improving work efficiency.

Bastionhost can block illegal access and malicious attacks, block illegal orders, and audit and monitor internal misoperations. Therefore, bastionhost has been well used in many industries.

The role of bastion hosts (1) Access control.

If O&M personnel legally access operations, bastion hosts can solve the problem of operating resources. By strictly controlling access to resources, Bastionhost ensures that O&M personnel can legally access operation resources within the valid permissions and time limits of their accounts, reducing operational risks, achieving security supervision and ensuring the safety, legal compliance, and controllability of O&M personnel.

The role of bastion host (2) Account management.

When O&M personnel use bastion hosts, whether they are using virtual machines or LAN hosts, they can synchronously import bastion hosts for centralized account management and batch password modification, and can set SSH key pairs in batches with one click.

The role of bastionhost (3) resource authorization.

Bastionhost supports various forms of host resource authorization, such as virtual machines and LAN hosts, and uses a role-based access control model to manage users, resources, and functions in detail, solving the O&M problems encountered by many O&M personnel, such as a large number of personnel, overlapping permissions, cumbersome assets, and replication of various permissions.

The role of bastionhost (4) Command review.

Bastionhost provides the security audit function to audit the account usage of O&M personnel, including login, resource access, and resource usage. For sensitive commands, Bastionhost can block or trigger an audit of the operation that fails to approve the sensitive command.

The role of bastionhost (5) Audit video.

In addition to providing security, bastion hosts can also take advantage of the features of Bastionhost's prior permission authorization, interception of sensitive commands during events, and post-operation and maintenance audits of Bastionhost. The O&M operations performed by O&M personnel in Bastion host are recorded in the form of logs, which are used by the administrator to audit and record the operations of MicroCloud personnel.

6. Identity authentication.

7. Operation audit of bastionhost.

Bastionhost can centrally manage and analyze all operation logs of O&M personnel, not only monitor and intercept user behaviors, but also perform data mining through centralized security audit data, so that O&M personnel can easily audit and identify security incidents.