Bastion host
A bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks, so named by analogy to the bastion, a military fortification. The computer generally hosts a single application or process, for example, a proxy server or load balancer, and all other services are removed or limited to reduce the threat to the computer. It is hardened in this manner primarily due to its location and purpose, which is either on the outside of a firewall or inside of a demilitarized zone (DMZ) and usually involves access from untrusted networks or computers. These computers are also equipped with special networking interfaces to withstand high-bandwidth attacks through the internet.
Definitions
The term is generally attributed to a 1990 article discussing firewalls by Marcus J. Ranum, who defined a bastion host as "a system identified by the firewall administrator as a critical strong point in the network security. Generally, bastion hosts will have some degree of extra attention paid to their security, may undergo regular audits, and may have modified software".[1]
It has also been described as "any computer that is fully exposed to attack by being on the public side of the DMZ, unprotected by a firewall or filtering router. Firewalls and routers, anything that provides perimeter access control security can be considered bastion hosts. Other types of bastion hosts can include web, mail, DNS, and FTP servers. Due to their exposure, a great deal of effort must be put into designing and configuring bastion hosts to minimize the chances of penetration".[2]
Placement
There are two common network configurations that include bastion hosts and their placement. The first requires two firewalls, with bastion hosts sitting between the first "outside world" firewall, and an inside firewall,REFERENCE FOR RFC4949 IS NOT DEFINED YET. You are invited to add it here. in a DMZ. Often, smaller networks do not have multiple firewalls, so if only one firewall exists in a network, bastion hosts are commonly placed outside the firewall.[3]
Use Cases
Though securing remote access is the main use case of a bastion server, there are a few more use cases of a bastion host such as:[4]
- Secure remote access
- Authentication gateway
- VPN alternative
- Alternative to internal admin tools
- Alternative to file transfers
- Alternative way to share resource credentials
- Intrusion detection
- Software inventory management
Examples
These are several examples of bastion host systems/services:
- DNS (Domain Name System) server
- Email server
- FTP (File Transfer Protocol) server
- Honeypot
- Proxy server
- VPN (virtual private network) server
- Web server
See also
References
- ↑ "Thinking about firewalls". Vtcif.telstra.com.au. 1990-01-20. http://www.vtcif.telstra.com.au/pub/docs/security/ThinkingFirewalls/ThinkingFirewalls.html. Retrieved 2012-01-19.
- ↑ Ronald L. Krutz; Russell Dean Vines (May 2003). The CISM Prep Guide: Mastering the Five Domains of Information Security Management. Wiley. p. 12. ISBN 978-0-471-45598-1.
- ↑ Steves, Kevin (October 16, 2002). "Building a Bastion Host Using HP-UX 11". http://www.windowsecurity.com/whitepapers/unix_security/Building_a_Bastion_Host_Using_HPUX_11.html.
- ↑ "Alternative Use Cases for a Bastion Host" (in en). Adaptive. https://adaptive.live/blog/alternative-use-cases-for-a-bastion-host.
 |  |
