Bastion Hosts

Access for the root user can be limited to be only allowed from certain bastion hosts.

By default this is enabled except for a few networks, see responsible Puppet code for details.

You may alternatively control the use of bastion hosts yourself by setting in Hiera the boolean value aaa::user_bastions.

The bastion hosts can be listed in the Hiera key aaa:bastions:

aaa::bastions:
- 'x05la-gw.psi.ch'

which then will override the default value

aaa::bastions:
  - 'mgt-gw-01.psi.ch'
  - '129.129.197.72' # IP of mgt-gw-01.psi.ch
  - 'mgt-gw-02.psi.ch'
  - '129.129.197.73' # IP of mgt-gw-02.psi.ch

Caution: an empty list will allow unrestricted login again!

816 B Raw Permalink Blame History

Bastion Hosts

816 B

Raw Permalink Blame History