{"id":25436726,"url":"https://github.com/kaalpanikh/bastion-host","last_synced_at":"2026-05-05T14:12:05.453Z","repository":{"id":277352023,"uuid":"931994833","full_name":"kaalpanikh/bastion-host","owner":"kaalpanikh","description":"Secure AWS bastion host setup with Terraform automation, fail2ban, and SSH hardening for private infrastructure access","archived":false,"fork":false,"pushed_at":"2025-02-13T13:06:34.000Z","size":15,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-13T14:23:41.329Z","etag":null,"topics":["aws","aws-ec2","bastion-host","cloud-security","devops","fail2ban","iac","infra-automation","infrastructure-as-code","network-security","security","ssh-hardening","terraform","vpc"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kaalpanikh.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-02-13T07:32:59.000Z","updated_at":"2025-02-13T13:12:15.000Z","dependencies_parsed_at":"2025-02-13T14:23:43.501Z","dependency_job_id":"33f06227-080c-4ff0-bac8-9def91b10e3c","html_url":"https://github.com/kaalpanikh/bastion-host","commit_stats":null,"previous_names":["kaalpanikh/bastion-host"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fbastion-host","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fbastion-host/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fbastion-host/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaalpanikh%2Fbastion-host/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kaalpanikh","download_url":"https://codeload.github.com/kaalpanikh/bastion-host/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254264766,"owners_count":22041794,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-ec2","bastion-host","cloud-security","devops","fail2ban","iac","infra-automation","infrastructure-as-code","network-security","security","ssh-hardening","terraform","vpc"],"created_at":"2025-02-17T08:22:12.054Z","updated_at":"2025-10-29T16:36:29.350Z","avatar_url":"https://github.com/kaalpanikh.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bastion Host Implementation Project\n\nProject URL: [roadmap.sh/projects/bastion-host](https://roadmap.sh/projects/bastion-host)\n\n## Project Overview\nThis project implements a secure bastion host architecture in AWS, providing a secure way to access private infrastructure. The implementation includes VPC setup, security configurations, and SSH hardening measures.\n\n## Architecture\n\n```mermaid\ngraph LR\n    Internet((Internet))\n    subgraph VPC [VPC 10.0.0.0/16]\n        subgraph Public [Public Subnet 10.0.1.0/24]\n            BH[Bastion Host\\nt2.micro]\n        end\n        subgraph Private [Private Subnet 10.0.2.0/24]\n            PS[Private Server\\nt2.micro]\n        end\n        IGW[Internet Gateway]\n    end\n    \n    Internet --\u003e IGW\n    IGW --\u003e BH\n    BH --\u003e PS\n    \n    style VPC fill:#f5f5f5,stroke:#333,stroke-width:2px\n    style Public fill:#e1f5fe,stroke:#333,stroke-width:1px\n    style Private fill:#ffebee,stroke:#333,stroke-width:1px\n    style BH fill:#b3e5fc,stroke:#333,stroke-width:1px\n    style PS fill:#ffcdd2,stroke:#333,stroke-width:1px\n    style IGW fill:#e8f5e9,stroke:#333,stroke-width:1px\n```\n\n### Components Created\n1. **VPC (10.0.0.0/16)**\n   - Public Subnet: 10.0.1.0/24\n   - Private Subnet: 10.0.2.0/24\n   - Internet Gateway\n   - Route Tables for public and private subnets\n\n2. **EC2 Instances**\n   - Bastion Host (Public)\n     - Instance Type: t2.micro\n     - AMI: Amazon Linux 2\n   - Private Server\n     - Instance Type: t2.micro\n     - AMI: Amazon Linux 2\n\n3. **Security Groups**\n   ```json\n   Bastion Security Group:\n   - Inbound: SSH (22) from 0.0.0.0/0\n   - Outbound: All traffic\n\n   Private Server Security Group:\n   - Inbound: SSH (22) from Bastion SG\n   - Outbound: All traffic\n   ```\n\n## Implementation Steps\n\n### 1. VPC Setup\n```bash\n# Create VPC\naws ec2 create-vpc --cidr-block 10.0.0.0/16\n\n# Create Subnets\naws ec2 create-subnet --vpc-id $VPC_ID --cidr-block 10.0.1.0/24\naws ec2 create-subnet --vpc-id $VPC_ID --cidr-block 10.0.2.0/24\n\n# Create and Attach Internet Gateway\naws ec2 create-internet-gateway\naws ec2 attach-internet-gateway --vpc-id $VPC_ID --internet-gateway-id $IGW_ID\n```\n\n### 2. Security Group Configuration\n```bash\n# Bastion Security Group\naws ec2 create-security-group --group-name bastion-sg \\\n  --description \"Security group for bastion host\" --vpc-id $VPC_ID\n\n# Private Server Security Group\naws ec2 create-security-group --group-name private-sg \\\n  --description \"Security group for private instance\" --vpc-id $VPC_ID\n```\n\n### 3. Instance Launch\n```bash\n# Launch Bastion Host\naws ec2 run-instances --image-id $AMI_ID --instance-type t2.micro \\\n  --key-name your-key-name --security-group-ids $BASTION_SG_ID \\\n  --subnet-id $PUBLIC_SUBNET_ID\n\n# Launch Private Server\naws ec2 run-instances --image-id $AMI_ID --instance-type t2.micro \\\n  --key-name your-key-name --security-group-ids $PRIVATE_SG_ID \\\n  --subnet-id $PRIVATE_SUBNET_ID\n```\n\n### 4. SSH Configuration\nExample SSH config:\n```\nHost bastion\n    HostName \u003cbastion-public-ip\u003e\n    User ec2-user\n    IdentityFile ~/.ssh/your-key.pem\n\nHost private-server\n    HostName \u003cprivate-server-private-ip\u003e\n    User ec2-user\n    ProxyJump bastion\n    IdentityFile ~/.ssh/your-key.pem\n```\n\n## Infrastructure Automation with Terraform\n\n### Directory Structure\n```\nterraform/\n├── main.tf              # Main Terraform configuration\n├── variables.tf         # Variable definitions\n├── outputs.tf          # Output definitions\n├── terraform.tfvars.example  # Example variables file\n└── scripts/\n    └── bastion_setup.sh     # Bastion host setup script\n```\n\n### Prerequisites\n1. [Terraform](https://www.terraform.io/downloads.html) installed (v1.0.0 or newer)\n2. AWS credentials configured\n3. SSH key pair created in AWS\n\n### Quick Start\n1. Clone this repository\n2. Navigate to the terraform directory:\n   ```bash\n   cd terraform\n   ```\n\n3. Copy and configure variables:\n   ```bash\n   cp terraform.tfvars.example terraform.tfvars\n   # Edit terraform.tfvars with your values\n   ```\n\n4. Initialize Terraform:\n   ```bash\n   terraform init\n   ```\n\n5. Review the execution plan:\n   ```bash\n   terraform plan\n   ```\n\n6. Apply the configuration:\n   ```bash\n   terraform apply\n   ```\n\n### What Gets Created\n- VPC with public and private subnets\n- Internet Gateway\n- Route tables\n- Security groups for bastion and private instances\n- EC2 instances (bastion host and private server)\n- Automatic security configurations:\n  - fail2ban installation and configuration\n  - SSH hardening\n  - Security group rules\n\n### Customization\nYou can customize the deployment by modifying:\n- `terraform.tfvars`: Change region, CIDR blocks, instance types\n- `scripts/bastion_setup.sh`: Modify security configurations\n- `main.tf`: Adjust resource configurations\n\n### Cleanup\nTo destroy all created resources:\n```bash\nterraform destroy\n```\n\n## Cleanup Process\nWhen you're done with the bastion host setup, follow these steps to clean up all AWS resources in the correct order to avoid dependency conflicts:\n\n### 1. Terminate EC2 Instances\n```bash\n# Terminate the bastion host\naws ec2 terminate-instances --instance-ids \u003cbastion-instance-id\u003e\n\n# Wait for instance to fully terminate\naws ec2 describe-instances --instance-ids \u003cbastion-instance-id\u003e\n# Check that state is \"terminated\"\n```\n\n### 2. Delete Network Components\nDelete components in this specific order to handle dependencies:\n\n1. Detach and Delete Internet Gateway:\n```bash\n# Detach from VPC\naws ec2 detach-internet-gateway \\\n    --internet-gateway-id \u003cigw-id\u003e \\\n    --vpc-id \u003cvpc-id\u003e\n\n# Delete the internet gateway\naws ec2 delete-internet-gateway --internet-gateway-id \u003cigw-id\u003e\n```\n\n2. Delete Security Groups:\n```bash\n# Delete private server security group\naws ec2 delete-security-group --group-id \u003cprivate-sg-id\u003e\n\n# Delete bastion host security group\naws ec2 delete-security-group --group-id \u003cbastion-sg-id\u003e\n```\n\n3. Delete Subnets:\n```bash\n# Delete public subnet\naws ec2 delete-subnet --subnet-id \u003cpublic-subnet-id\u003e\n\n# Delete private subnet\naws ec2 delete-subnet --subnet-id \u003cprivate-subnet-id\u003e\n```\n\n4. Delete Route Tables:\n```bash\n# Delete custom route tables\naws ec2 delete-route-table --route-table-id \u003croute-table-id\u003e\n```\n\n5. Delete VPC:\n```bash\n# Finally, delete the VPC\naws ec2 delete-vpc --vpc-id \u003cvpc-id\u003e\n```\n\n### Verification Steps\nAfter deletion, verify that all resources are removed:\n\n```bash\n# Check VPC\naws ec2 describe-vpcs --vpc-id \u003cvpc-id\u003e\n# Should return: InvalidVpcID.NotFound\n\n# Check Security Groups\naws ec2 describe-security-groups --group-ids \u003csg-id\u003e\n# Should return: InvalidGroup.NotFound\n\n# Check Subnets\naws ec2 describe-subnets --subnet-ids \u003csubnet-id\u003e\n# Should return: InvalidSubnetID.NotFound\n\n# Check Internet Gateway\naws ec2 describe-internet-gateways --internet-gateway-ids \u003cigw-id\u003e\n# Should return: InvalidInternetGatewayID.NotFound\n```\n\n### Common Issues During Cleanup\n1. **Dependency Violations**: If you receive a dependency violation error, it means you're trying to delete a resource that other resources still depend on. Follow the order specified above.\n\n2. **Resource Still in Use**: Sometimes AWS needs a few minutes to fully process the termination of resources. Wait a few minutes and try again.\n\n3. **Main Route Table**: The main route table associated with the VPC will be automatically deleted when the VPC is deleted.\n\n### Cost Implications\n- Terminating resources stops any ongoing charges\n- Check your AWS billing dashboard to confirm no unexpected charges\n- Some resources like EBS volumes might need separate deletion if not set to auto-delete\n\n## Proof of Implementation\n\n### 1. VPC and Subnet Creation\n```bash\n$ aws ec2 describe-vpcs\n{\n    \"Vpcs\": [\n        {\n            \"CidrBlock\": \"10.0.0.0/16\",\n            \"State\": \"available\",\n            \"VpcId\": \"vpc-xxxxx\",\n            \"InstanceTenancy\": \"default\",\n            \"CidrBlockAssociationSet\": [\n                {\n                    \"CidrBlock\": \"10.0.0.0/16\",\n                    \"CidrBlockState\": {\n                        \"State\": \"associated\"\n                    }\n                }\n            ],\n            \"Tags\": [\n                {\n                    \"Key\": \"Name\",\n                    \"Value\": \"bastion-vpc\"\n                }\n            ]\n        }\n    ]\n}\n```\n\n### 2. Security Groups Configuration\n```bash\n$ aws ec2 describe-security-groups\n{\n    \"SecurityGroups\": [\n        {\n            \"GroupName\": \"bastion-sg\",\n            \"Description\": \"Security group for bastion host\",\n            \"IpPermissions\": [\n                {\n                    \"FromPort\": 22,\n                    \"IpProtocol\": \"tcp\",\n                    \"IpRanges\": [\n                        {\n                            \"CidrIp\": \"0.0.0.0/0\"\n                        }\n                    ],\n                    \"ToPort\": 22\n                }\n            ]\n        },\n        {\n            \"GroupName\": \"private-sg\",\n            \"Description\": \"Security group for private instance\",\n            \"IpPermissions\": [\n                {\n                    \"FromPort\": 22,\n                    \"IpProtocol\": \"tcp\",\n                    \"UserIdGroupPairs\": [\n                        {\n                            \"GroupId\": \"\u003cbastion-sg-id\u003e\"\n                        }\n                    ],\n                    \"ToPort\": 22\n                }\n            ]\n        }\n    ]\n}\n```\n\n### 3. EC2 Instances\n```bash\n$ aws ec2 describe-instances --query \"Reservations[*].Instances[*].[Tags[?Key=='Name'].Value|[0],State.Name]\" --output table\n---------------------------------\n|       DescribeInstances        |\n+---------------+---------------+\n|  bastion-host |  running     |\n|  private-server|  running     |\n+---------------+---------------+\n```\n\n### 4. SSH Configuration File\n```bash\n$ cat ~/.ssh/config\nHost bastion\n    HostName \u003cbastion-public-ip\u003e\n    User ec2-user\n    IdentityFile ~/.ssh/your-key.pem\n\nHost private-server\n    HostName \u003cprivate-ip\u003e\n    User ec2-user\n    ProxyJump bastion\n    IdentityFile ~/.ssh/your-key.pem\n```\n\n### 5. fail2ban Installation and Configuration\n```bash\n$ ssh bastion \"systemctl status fail2ban\"\n● fail2ban.service - Fail2Ban Service\n   Loaded: loaded\n   Active: active (running)\n```\n\n### 6. SSH Hardening Verification\n```bash\n$ ssh bastion \"sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|x11forwarding'\"\npermitrootlogin no\npasswordauthentication no\nx11forwarding no\n```\n\n### 7. Connection Tests\n```bash\n$ ssh bastion \"echo 'Connection to bastion host successful!'\"\nConnection to bastion host successful!\n\n$ ssh private-server \"echo 'Connection to private server successful!'\"\nConnection to private server successful!\n```\n\n## Security Features\n1. **Network Security**\n   - Private server accessible only through bastion host\n   - Public subnet with Internet Gateway for bastion\n   - Private subnet for secure server\n\n2. **Access Control**\n   - Key-based authentication only\n   - fail2ban for brute force protection\n   - No root login allowed\n   - SSH hardening configurations\n\n3. **Monitoring**\n   - SSH session logging\n   - fail2ban logs for access attempts\n\n## Challenges Faced\n1. **SSH Access Issues**\n   - Problem: Lost SSH access after implementing strict security measures\n   - Solution Attempted: Created temporary security group for recovery\n   - Status: Access recovery in progress\n\n2. **Security Implementation**\n   - MFA implementation pending\n   - iptables configuration pending\n\n## Future Improvements\n1. Implement Multi-Factor Authentication (MFA)\n2. Configure iptables for granular traffic filtering\n3. Set up CloudWatch monitoring\n4. Implement automatic security patches\n5. Add backup and disaster recovery procedures\n\n## Resources Used\n1. [AWS VPC Documentation](https://docs.aws.amazon.com/vpc/)\n2. [AWS EC2 Documentation](https://docs.aws.amazon.com/ec2/)\n3. [OpenSSH Documentation](https://www.openssh.com/manual.html)\n4. [fail2ban Documentation](https://www.fail2ban.org/wiki/index.php/Main_Page)\n\n## Project Status\n- Core infrastructure: Complete\n- Basic security measures: Complete\n- Advanced security (MFA, iptables): Pending\n- Documentation: Complete","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkaalpanikh%2Fbastion-host","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkaalpanikh%2Fbastion-host","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkaalpanikh%2Fbastion-host/lists"}