# Bastion Hosts

Access for the `root` user can be limited to be only allowed from certain bastion hosts.

By default this is enabled except for a few networks, see [responsible Puppet code](https://gitea.psi.ch/puppet/puppet/src/branch/preprod/code/modules/profile/manifests/networking/params.pp) for details.

You may alternatively control the use of bastion hosts yourself by setting in Hiera the boolean value `aaa::user_bastions`.

The bastion hosts can be listed in the Hiera key `aaa:bastions`:

```
aaa::bastions:
- 'x05la-gw.psi.ch'
```

which then will override the default value
```
aaa::bastions:
  - 'mgt-gw-01.psi.ch'
  - '129.129.197.72' # IP of mgt-gw-01.psi.ch
  - 'mgt-gw-02.psi.ch'
  - '129.129.197.73' # IP of mgt-gw-02.psi.ch
```

**Caution**: an empty list will allow unrestricted login again!