https://github.com/tg123/azbastion
go version of az network bastion tunnel
https://github.com/tg123/azbastion
Last synced: 2 months ago
JSON representation
go version of az network bastion tunnel
- Host: GitHub
- URL: https://github.com/tg123/azbastion
- Owner: tg123
- License: mit
- Created: 2023-04-27T06:03:38.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2024-05-15T17:45:20.000Z (over 1 year ago)
- Last Synced: 2025-03-27T08:30:57.071Z (7 months ago)
- Language: Go
- Homepage:
- Size: 50.8 KB
- Stars: 1
- Watchers: 2
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Azure Bastion tunnel client
## Basic Usage
```
bastion-tunnel --subscription --group --name --target-addr --target-port --local-port
```
## Advanced: Use a non-exportable ssh key in azure key vault
Traditional SSH client key-authenticatio requires a `PRIVATE` key at client side to establish connection to ssh server.
Nonetheless, sharing the private key poses a significant security risk. Even placing the key in a key vault as a secret does not mitigate this risk, as individuals might still retain a local copy of the key despite their access to the key vault being revoked.
Conversely, the `bastion-tunnel` approach allows the utilization of a non-exportable RSA key stored in the key vault to authenticate with the ssh server located behind the bastion. This implementation significantly enhances the security level of the bastion, further safeguarding sensitive access.
### Generate Key
* Azure Portal
* Powershell
`Add-AzKeyVaultKey -VaultName -Name -Destination Software -KeyType RSA`
### Connection sshd behind bastion using the key
_NOTE_: public key will be in stdout after your first run, you can add it to ssh server's `~/.ssh/authorized_keys`
```
bastion-tunnel --subscription --group --name --target-addr --run-ssh --ssh-user --ssh-keyvault-url "https://.vault.azure.net" --ssh-keyvault-keyname
```
## Limitation
You bastion must be Standard SKU and enable `Native client support` and `IP-based connection`