What exactly does this template configure?

It hardens the SSH configuration (MaxAuthTries, LoginGraceTime, unnecessary options disabled), installs fail2ban, and enables the auditd system audit and a UFW firewall that allows only SSH.

Is SSH password authentication disabled automatically?

No, to avoid locking yourself out: the template hardens SSH without disabling password authentication. Add your public key first, then disable password authentication manually.

Client Area

Cybersecurity & Bastion

Bastion Host

Name: Bastion Host
Availability: InStock

A secure, hardened SSH entry point to your infrastructure, with centralised auditing.

Official documentation

root@mon-serveur — ssh

# when the VPS is created
✓ Bastion Host installedroot@mon-serveur:~#

About Bastion Host

A bastion (SSH jump host) is the single, hardened entry point through which all administrative connections to your private servers pass. Rather than exposing every machine, you expose only one reinforced host that is monitored and logged — drastically reducing your infrastructure's attack surface.

Deployed on a dedicated VPS, this template configures and hardens the SSH service (attempt limiting, connection grace periods, disabling of unnecessary options), installs fail2ban to automatically ban malicious IPs, and enables system auditing (auditd) and a UFW firewall. SSH forwarding stays enabled to act as a jump to your internal servers, while keeping a centralised access log.

What gets installed

Ready when the VPS starts

Compatible OS: Ubuntu 24.04
Application: Bastion Host
Tech stack: SSHfail2banauditdUFW
Minimum RAM: 1 GB
Minimum CPU: 1 vCPU
Default port: 22 (SSH)
Access: root over SSH

Key features

Hardened SSH: attempt limiting, grace period, unnecessary options disabled
fail2ban: automatic IP banning after repeated failures
System auditing (auditd) for traceability of access and commands
Pre-configured UFW firewall (SSH allowed, everything else closed)
SSH forwarding retained for jumping to private servers
Attack surface reduced to a single monitored entry point

When to use this solution?

Access to private servers

Centralise all administrative connections through a single hardened host, instead of exposing each server on the Internet.

Access traceability

Keep a centralised log of who connects, when and to which servers, for auditing and compliance.

Attack surface reduction

Close direct SSH access to your internal machines and expose only a single reinforced, monitored entry point.

Guide

Deploy Bastion Host on your VPS

Create the VPS
A VPS with 1 GB RAM, Ubuntu 24.04. The "Bastion Host" template hardens SSH and installs fail2ban, auditd and UFW automatically.
Add your public key
Add your public SSH key to the bastion (~/.ssh/authorized_keys) before disabling password authentication.
Configure the jump
From your machine, use the bastion as a ProxyJump (ssh -J bastion utilisateur@serveur-prive) to reach your internal servers.
Lock down direct access
Restrict SSH access on your private servers to the bastion's IP through their firewall, to close off any direct connection.

Frequently asked questions

Questions about Bastion Host

← Back to Cybersecurity & Bastion All applications

A bastion is a hardened server that acts as the single entry point to a private infrastructure. All administrative connections pass through it, which reduces the attack surface and centralises auditing.

With OpenSSH's ProxyJump option: ssh -J utilisateur@bastion utilisateur@serveur-prive. SSH forwarding stays enabled on the bastion for this purpose.

Embed the deploy button

Maintaining a project that uses Bastion Host? This button lets your readers deploy it on a VPS in one click, without reading Docker documentation.

Markdown

[![Deploy Bastion Host on ServOrbit](https://servorbit.com/brand/deploy/button.svg)](https://servorbit.com/vps-cloud?template=bastion-host&utm_source=deploy-badge&utm_medium=referral&utm_campaign=bastion-host)

HTML

<a href="https://servorbit.com/vps-cloud?template=bastion-host&utm_source=deploy-badge&utm_medium=referral&utm_campaign=bastion-host"><img src="https://servorbit.com/brand/deploy/button.svg" alt="Deploy Bastion Host on ServOrbit" height="40"></a>

The button points to a VPS order with the template preselected. The image is served from servorbit.com — nothing to host on your side.