Why go through an SSH bastion?
A bastion reduces the attack surface: instead of opening SSH on each server, you concentrate access on a dedicated machine. Keys, users and logs are simpler to control, and internal servers can stay closed to the public network.
What this template brings
- A single entry point for administrator SSH access.
- Named keys rather than a shared password.
- A simple foundation for logging connections and sensitive commands.
- Reduced network exposure for the application servers behind the bastion.
- A foundation compatible with the classic tools: OpenSSH, ProxyJump, UFW and Fail2Ban.
Requirements before opening it to the team
Plan for a lightweight but isolated VPS, a clear list of authorized people, individual SSH keys and a firewall rule that opens only the necessary SSH port. For a distributed team, also document the username format and the revocation procedure.
Deploy a bastion properly
Create the dedicated VPS
Select the Bastion Host template in the ServOrbit Marketplace or start from a minimal Ubuntu. Keep this server dedicated to SSH access: no website, no database, no ancillary services.
Set up the named keys
Add one key per administrator in ~/.ssh/authorized_keys. Avoid shared accounts: in case of a departure or rotation, you must be able to remove a single key without blocking the whole team.
Harden OpenSSH
Disable password authentication, block direct root login and limit authorized users with AllowUsers or AllowGroups in sshd_config.
Configure ProxyJump
On administrator workstations, add a ProxyJump entry in ~/.ssh/config. Internal servers remain accessible over SSH through the bastion, with no public port open.
Monitor and revoke
Enable Fail2Ban if the SSH port remains exposed and regularly check /var/log/auth.log. Immediately remove keys that are no longer used.
ServOrbit tip
Keep the bastion small, predictable and separate from the rest. Its value comes from its simplicity: the fewer services it hosts, the easier it is to audit.
The official documentation
For advanced configuration, options specific to the tool, and version changes, refer to the official OpenSSH documentation. This guide covers deployment on a ServOrbit VPS; the vendor's documentation remains the reference for fine-tuning.
