[{"data":1,"prerenderedAt":144},["ShallowReactive",2],{"seo-verification":3,"blog-bastion-host-on-vps-securing-your-ssh-access-ma-en":6,"promo-bar-likely":143},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-bastion-host-on-vps-securing-your-ssh-access-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":35,"sections":36,"ctaTitle":82,"ctaBody":83,"ctaButton":84,"ctaUrl":85,"relatedPosts":86},158,"bastion-host-on-vps-securing-your-ssh-access",{"fr":12,"en":10,"ar":13,"es":14},"heberger-bastion-host-vps","مضيف-bastion-على-خادم-vps-تأمين-وصولك-عبر-ssh","bastion-host-en-vps-accesos-ssh","Bastion Host on VPS: securing your SSH access","Deploy a Bastion Host on a ServOrbit VPS: a hardened SSH entry point, centralized access, logs and security rules.",3,2,false,"2026-07-05T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fheberger-bastion-host-vps-poster.svg",{"categorySlug":27,"appSlug":34},"bastion-host","An SSH bastion avoids exposing each server directly on the Internet: administrators go through a hardened, logged and easy-to-audit entry point. On a ServOrbit VPS, this role stays clear: a stable IP, OpenSSH, named keys and minimal firewall rules. This guide presents a lean setup, useful for a small team as well as for an agency administering several machines.",[37,41,50,53,75,79],{"type":38,"title":39,"body":40},"h2","Why go through an SSH bastion?","A bastion reduces the attack surface: instead of opening SSH on each server, you concentrate access on a dedicated machine. Keys, users and logs are simpler to control, and internal servers can stay closed to the public network.",{"type":42,"title":43,"items":44},"ul","What this template brings",[45,46,47,48,49],"A single entry point for administrator SSH access.","Named keys rather than a shared password.","A simple foundation for logging connections and sensitive commands.","Reduced network exposure for the application servers behind the bastion.","A foundation compatible with the classic tools: OpenSSH, ProxyJump, UFW and Fail2Ban.",{"type":38,"title":51,"body":52},"Requirements before opening it to the team","Plan for a lightweight but isolated VPS, a clear list of authorized people, individual SSH keys and a firewall rule that opens only the necessary SSH port. For a distributed team, also document the username format and the revocation procedure.",{"type":54,"title":55,"steps":56},"steps","Deploy a bastion properly",[57,60,63,66,69,72],{"title":58,"body":59},"Create the dedicated VPS","Select the Bastion Host template in the ServOrbit Marketplace or start from a minimal Ubuntu. Keep this server dedicated to SSH access: no website, no database, no ancillary services.",{"title":61,"body":62},"Set up the named keys","Add one key per administrator in `~\u002F.ssh\u002Fauthorized_keys`. Avoid shared accounts: in case of a departure or rotation, you must be able to remove a single key without blocking the whole team.",{"title":64,"body":65},"Harden OpenSSH","Disable password authentication, block direct root login and limit authorized users with `AllowUsers` or `AllowGroups` in `sshd_config`.",{"title":67,"body":68},"Configure ProxyJump","On administrator workstations, add a `ProxyJump` entry in `~\u002F.ssh\u002Fconfig`. Internal servers remain accessible over SSH through the bastion, with no public port open.",{"title":70,"body":71},"Monitor and revoke","Enable Fail2Ban if the SSH port remains exposed and regularly check `\u002Fvar\u002Flog\u002Fauth.log`. Immediately remove keys that are no longer used.",{"title":73,"body":74},"Logging in for the first time","This recipe opens no interface: it hardens the SSH service already delivered with your VPS, so you carry on connecting over SSH with the access details you received on delivery. Please note: only 3 authentication attempts are allowed, and fail2ban bans the IP address for 1 hour after 4 failures within 10 minutes.",{"type":76,"title":77,"body":78},"tip","ServOrbit tip","Keep the bastion small, predictable and separate from the rest. Its value comes from its simplicity: the fewer services it hosts, the easier it is to audit.",{"type":76,"title":80,"body":81},"The official documentation","For advanced configuration, options specific to the tool, and version changes, refer to the \u003Ca href=\"https:\u002F\u002Fman.openbsd.org\u002Fsshd_config\" target=\"_blank\" rel=\"noopener noreferrer\">official OpenSSH documentation\u003C\u002Fa>. This guide covers deployment on a ServOrbit VPS; the vendor's documentation remains the reference for fine-tuning.","Centralize your SSH access on a ServOrbit VPS","The Bastion Host template gives you a clear entry point to administer your servers without exposing each machine directly on the Internet.","Deploy the bastion","\u002Fvps-cloud",[87,107,125],{"id":88,"slug":89,"slugs":90,"title":94,"excerpt":95,"readTime":96,"views":97,"isPinned":19,"noindex":19,"publishedAt":98,"updatedAt":99,"category":100,"categories":101,"featuredImage":30,"bgImage":31,"posterImage":103,"relatedSolution":104},109,"fail2ban-enhanced-on-vps-blocking-repeated-attacks",{"fr":91,"en":89,"ar":92,"es":93},"proteger-vps-fail2ban","fail2ban-enhanced-على-خادم-vps-حجب-الهجمات-المتكررة","fail2ban-en-vps-bloquear-ataques-repetidos","Fail2Ban Enhanced on VPS: blocking repeated attacks","Link Fail2Ban Enhanced to the ServOrbit catalog: SSH\u002FNginx banning, readable logs and official documentation.",11,1,"2026-03-03T00:00:00+00:00","2026-11-01T14:14:36+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[102],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fproteger-vps-fail2ban-poster.svg",{"categorySlug":105,"appSlug":106},"securite","fail2ban-enhanced",{"id":108,"slug":109,"slugs":110,"title":114,"excerpt":115,"readTime":116,"views":18,"isPinned":19,"noindex":19,"publishedAt":117,"updatedAt":118,"category":119,"categories":120,"featuredImage":30,"bgImage":31,"posterImage":122,"relatedSolution":123},141,"wireguard-on-a-vps-a-fast-lean-and-private-vpn",{"fr":111,"en":109,"ar":112,"es":113},"installer-wireguard-vps","wireguard-على-خادم-vps-شبكة-vpn-سريعة-ومبسطة-وخاصة","wireguard-en-un-vps-vpn-rapido-y-privado","WireGuard on a VPS: a fast, lean and private VPN","Deploy WireGuard on a ServOrbit VPS: fast tunnels, readable configuration, client QR codes and private remote access.",7,"2026-02-04T00:00:00+00:00","2026-11-08T01:13:12+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[121],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Finstaller-wireguard-vps-poster.svg",{"categorySlug":105,"appSlug":124},"wireguard-server",{"id":126,"slug":127,"slugs":128,"title":132,"excerpt":133,"readTime":134,"views":18,"isPinned":19,"noindex":19,"publishedAt":135,"updatedAt":21,"category":136,"categories":137,"featuredImage":30,"bgImage":31,"posterImage":139,"relatedSolution":140},108,"securing-your-vps-with-crowdsec",{"fr":129,"en":127,"ar":130,"es":131},"securiser-vps-crowdsec","تأمين-خادمك-الافتراضي-vps-باستخدام-crowdsec","proteger-vps-con-crowdsec","Securing your VPS with CrowdSec","Deploy CrowdSec on your VPS to block attacks thanks to behavioral detection and a shared community blocklist.",4,"2026-03-04T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[138],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fsecuriser-vps-crowdsec-poster.svg",{"categorySlug":141,"appSlug":142},"cybersecurity-bastion","crowdsec",true,1794270370350]