[{"data":1,"prerenderedAt":132},["ShallowReactive",2],{"seo-verification":3,"blog-bastion-host-on-vps-securing-your-ssh-access-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":31,"sections":32,"ctaTitle":78,"ctaBody":79,"ctaButton":80,"ctaUrl":81,"relatedPosts":82},158,"bastion-host-on-vps-securing-your-ssh-access",{"fr":10,"en":8,"ar":11},"heberger-bastion-host-vps","مضيف-bastion-على-خادم-vps-تأمين-وصولك-عبر-ssh","Bastion Host on VPS: securing your SSH access","Deploy a Bastion Host on a ServOrbit VPS: a hardened SSH entry point, centralized access, logs and security rules.",2,0,false,"2026-07-05T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fheberger-bastion-host-vps-poster.svg",{"categorySlug":23,"appSlug":30},"bastion-host","An SSH bastion avoids exposing each server directly on the Internet: administrators go through a hardened, logged and easy-to-audit entry point. On a ServOrbit VPS, this role stays clear: a stable IP, OpenSSH, named keys and minimal firewall rules. This guide presents a lean setup, useful for a small team as well as for an agency administering several machines.",[33,37,46,49,71,75],{"type":34,"title":35,"body":36},"h2","Why go through an SSH bastion?","A bastion reduces the attack surface: instead of opening SSH on each server, you concentrate access on a dedicated machine. Keys, users and logs are simpler to control, and internal servers can stay closed to the public network.",{"type":38,"title":39,"items":40},"ul","What this template brings",[41,42,43,44,45],"A single entry point for administrator SSH access.","Named keys rather than a shared password.","A simple foundation for logging connections and sensitive commands.","Reduced network exposure for the application servers behind the bastion.","A foundation compatible with the classic tools: OpenSSH, ProxyJump, UFW and Fail2Ban.",{"type":34,"title":47,"body":48},"Requirements before opening it to the team","Plan for a lightweight but isolated VPS, a clear list of authorized people, individual SSH keys and a firewall rule that opens only the necessary SSH port. For a distributed team, also document the username format and the revocation procedure.",{"type":50,"title":51,"steps":52},"steps","Deploy a bastion properly",[53,56,59,62,65,68],{"title":54,"body":55},"Create the dedicated VPS","Select the Bastion Host template in the ServOrbit Marketplace or start from a minimal Ubuntu. Keep this server dedicated to SSH access: no website, no database, no ancillary services.",{"title":57,"body":58},"Set up the named keys","Add one key per administrator in `~\u002F.ssh\u002Fauthorized_keys`. Avoid shared accounts: in case of a departure or rotation, you must be able to remove a single key without blocking the whole team.",{"title":60,"body":61},"Harden OpenSSH","Disable password authentication, block direct root login and limit authorized users with `AllowUsers` or `AllowGroups` in `sshd_config`.",{"title":63,"body":64},"Configure ProxyJump","On administrator workstations, add a `ProxyJump` entry in `~\u002F.ssh\u002Fconfig`. Internal servers remain accessible over SSH through the bastion, with no public port open.",{"title":66,"body":67},"Monitor and revoke","Enable Fail2Ban if the SSH port remains exposed and regularly check `\u002Fvar\u002Flog\u002Fauth.log`. Immediately remove keys that are no longer used.",{"title":69,"body":70},"Logging in for the first time","This recipe opens no interface: it hardens the SSH service already delivered with your VPS, so you carry on connecting over SSH with the access details you received on delivery. Please note: only 3 authentication attempts are allowed, and fail2ban bans the IP address for 1 hour after 4 failures within 10 minutes.",{"type":72,"title":73,"body":74},"tip","ServOrbit tip","Keep the bastion small, predictable and separate from the rest. Its value comes from its simplicity: the fewer services it hosts, the easier it is to audit.",{"type":72,"title":76,"body":77},"The official documentation","For advanced configuration, options specific to the tool, and version changes, refer to the \u003Ca href=\"https:\u002F\u002Fman.openbsd.org\u002Fsshd_config\" target=\"_blank\" rel=\"noopener noreferrer\">official OpenSSH documentation\u003C\u002Fa>. This guide covers deployment on a ServOrbit VPS; the vendor's documentation remains the reference for fine-tuning.","Centralize your SSH access on a ServOrbit VPS","The Bastion Host template gives you a clear entry point to administer your servers without exposing each machine directly on the Internet.","Deploy the bastion","\u002Fvps-cloud",[83,100,116],{"id":84,"slug":85,"slugs":86,"title":89,"excerpt":90,"readTime":91,"views":15,"isPinned":16,"publishedAt":92,"category":93,"categories":94,"featuredImage":26,"bgImage":27,"posterImage":96,"relatedSolution":97},109,"fail2ban-enhanced-on-vps-blocking-repeated-attacks",{"fr":87,"en":85,"ar":88},"proteger-vps-fail2ban","fail2ban-enhanced-على-خادم-vps-حجب-الهجمات-المتكررة","Fail2Ban Enhanced on VPS: blocking repeated attacks","Link Fail2Ban Enhanced to the ServOrbit catalog: SSH\u002FNginx banning, readable logs and official documentation.",3,"2026-03-03T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[95],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fproteger-vps-fail2ban-poster.svg",{"categorySlug":98,"appSlug":99},"securite","fail2ban-enhanced",{"id":101,"slug":102,"slugs":103,"title":106,"excerpt":107,"readTime":108,"views":15,"isPinned":16,"publishedAt":109,"category":110,"categories":111,"featuredImage":26,"bgImage":27,"posterImage":113,"relatedSolution":114},141,"wireguard-on-a-vps-a-fast-lean-and-private-vpn",{"fr":104,"en":102,"ar":105},"installer-wireguard-vps","wireguard-على-خادم-vps-شبكة-vpn-سريعة-ومبسطة-وخاصة","WireGuard on a VPS: a fast, lean and private VPN","Deploy WireGuard on a ServOrbit VPS: fast tunnels, readable configuration, client QR codes and private remote access.",4,"2026-02-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[112],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Finstaller-wireguard-vps-poster.svg",{"categorySlug":98,"appSlug":115},"wireguard-server",{"id":117,"slug":118,"slugs":119,"title":122,"excerpt":123,"readTime":108,"views":15,"isPinned":16,"publishedAt":124,"category":125,"categories":126,"featuredImage":26,"bgImage":27,"posterImage":128,"relatedSolution":129},108,"securing-your-vps-with-crowdsec",{"fr":120,"en":118,"ar":121},"securiser-vps-crowdsec","تأمين-خادمك-الافتراضي-vps-باستخدام-crowdsec","Securing your VPS with CrowdSec","Deploy CrowdSec on your VPS to block attacks thanks to behavioral detection and a shared community blocklist.","2026-03-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[127],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fsecuriser-vps-crowdsec-poster.svg",{"categorySlug":130,"appSlug":131},"cybersecurity-bastion","crowdsec",1787580992385]