Capstone Project 2 — Configure a Bastion Host¶
A Bastion Host (also called a Jump Server or Jump Box) is a hardened Linux server that acts as the single secure entry point for administrators to access private infrastructure. Instead of exposing every production server to the Internet, only the Bastion Host is publicly accessible, while all other servers remain inside a private network. In this capstone project, you'll build a production-ready Bastion Host with SSH hardening, firewall protection, user management, auditing, monitoring, and logging.
Project Overview¶
Objective¶
Build a secure Bastion Host that provides controlled administrative access to private Linux servers.
Skills Covered¶
- Linux Administration
- SSH Hardening
- Public Key Authentication
- User Management
- Firewall Configuration
- Network Security
- Audit Logging
- Fail2Ban
- Monitoring
- System Hardening
- Access Control
- Production Validation
Estimated Time¶
5–7 Hours
Difficulty¶
Beginner → Advanced
Project Architecture¶
Internet
│
│
SSH (22)
│
+----------------------+
| Bastion Host |
| Public IP Address |
+----------------------+
│
Private Network
│
┌─────────────┼─────────────┐
│ │ │
+-------------+ +-------------+ +-------------+
| App Server | | DB Server | | K8s Node |
| Private IP | | Private IP | | Private IP |
+-------------+ +-------------+ +-------------+
Learning Outcomes¶
By completing this project, you'll be able to:
- Build a Bastion Host
- Secure SSH access
- Configure key-based authentication
- Restrict administrative access
- Protect servers with firewalls
- Enable audit logging
- Monitor administrative activity
- Validate production readiness
Project Requirements¶
Hardware¶
Minimum
- 2 vCPU
- 2 GB RAM
- 20 GB Disk
Recommended
- 2–4 vCPU
- 4 GB RAM
- 40 GB SSD
Operating System¶
Choose one:
- Ubuntu Server 24.04 LTS
- Ubuntu Server 22.04 LTS
- Rocky Linux 9
- AlmaLinux 9
This project uses Ubuntu Server.
Software Stack¶
- Ubuntu Server
- OpenSSH Server
- UFW
- Fail2Ban
- rsyslog
- auditd
- rsync
Project Tasks¶
| Phase | Task |
|---|---|
| 1 | Install Linux |
| 2 | Configure Networking |
| 3 | Create Administrator Accounts |
| 4 | Configure SSH Keys |
| 5 | Harden SSH |
| 6 | Configure Firewall |
| 7 | Install Fail2Ban |
| 8 | Configure Audit Logging |
| 9 | Configure Monitoring |
| 10 | Configure Backup |
| 11 | Validate Access |
| 12 | Production Hardening |
Phase 1 — Install Linux¶
Update the server.
Verify OS.
Phase 2 — Configure Networking¶
Configure hostname.
Verify networking.
Verify connectivity.
Phase 3 — Create Administrator Accounts¶
Create administrator.
Grant sudo.
Verify.
Create separate accounts for every administrator.
Never share administrator accounts.
Phase 4 — Configure SSH Keys¶
Generate key pair on administrator workstation.
Copy public key.
Test login.
Phase 5 — Harden SSH¶
Edit SSH configuration.
Recommended configuration:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
MaxAuthTries 3
X11Forwarding no
AllowUsers admin1
Restart SSH.
Verify.
Phase 6 — Configure Firewall¶
Install UFW.
Allow SSH.
Enable firewall.
Verify.
Phase 7 — Install Fail2Ban¶
Install.
Enable.
Verify.
Phase 8 — Configure Audit Logging¶
Install auditd.
Enable service.
Verify.
Review audit logs.
Phase 9 — Configure Monitoring¶
CPU.
Memory.
Disk.
Services.
Logs.
Phase 10 — Configure Backup¶
Backup SSH configuration.
Backup administrator home.
Verify.
Phase 11 — Validate Administrative Access¶
Verify SSH login.
Verify SSH keys.
Display active users.
Review login history.
Phase 12 — Production Hardening¶
Review listening ports.
Review running services.
Remove unused packages.
Install updates.
Final Project Checklist¶
| Item | Status |
|---|---|
| Linux Installed | ☐ |
| Updates Applied | ☐ |
| Hostname Configured | ☐ |
| Administrator Accounts Created | ☐ |
| SSH Keys Configured | ☐ |
| Root Login Disabled | ☐ |
| Password Authentication Disabled | ☐ |
| Firewall Enabled | ☐ |
| Fail2Ban Configured | ☐ |
| Audit Logging Enabled | ☐ |
| Monitoring Verified | ☐ |
| Backup Created | ☐ |
| Production Validation Completed | ☐ |
Security Validation¶
Verify:
SSH
Firewall
Fail2Ban
Audit
Listening ports
Production Perspective¶
Bastion Hosts are commonly used in:
- AWS
- Microsoft Azure
- Google Cloud
- Oracle Cloud
- Kubernetes clusters
- Enterprise data centers
- Financial institutions
- Government infrastructure
Modern cloud environments often place Bastion Hosts inside dedicated management subnets protected by strict firewall rules.
Hands-on Lab¶
Task 1¶
Create two administrator accounts.
Task 2¶
Configure SSH key authentication.
Task 3¶
Disable password authentication.
Task 4¶
Enable UFW and allow only SSH.
Task 5¶
Install and configure Fail2Ban.
Task 6¶
Install auditd and verify audit logging.
Task 7¶
Review authentication logs.
Task 8¶
Connect through the Bastion Host and SSH into a private Linux server using key-based authentication.
Production Best Practices¶
- Never allow direct SSH access to private production servers.
- Use unique administrator accounts.
- Require SSH key authentication.
- Disable root login.
- Restrict firewall access.
- Enable auditing.
- Monitor login activity.
- Rotate SSH keys periodically.
- Keep the Bastion Host fully patched.
- Review access logs regularly.
Challenge Tasks¶
Complete these additional tasks to extend the project:
- Configure SSH Agent Forwarding securely.
- Restrict SSH access by source IP address.
- Configure Multi-Factor Authentication (MFA) for SSH.
- Forward audit logs to a centralized logging server.
- Install Prometheus Node Exporter for monitoring.
- Configure automatic security updates.
- Implement SSH login banners.
- Configure session timeout for inactive users.
- Restrict administrator access using Linux groups.
- Build a secondary Bastion Host for High Availability.
Skills Demonstrated¶
After completing this project, you will have demonstrated proficiency in:
- Linux Security
- SSH Administration
- Bastion Host Design
- Access Control
- Firewall Management
- Audit Logging
- Production Hardening
- Monitoring
- Backup
- Enterprise Linux Administration
Congratulations!¶
You have successfully built a production-ready Bastion Host.
Your Bastion Host now provides a secure, centralized, and auditable entry point for administering private Linux infrastructure while minimizing the attack surface of your production environment.
This architecture is widely used in enterprise data centers and cloud platforms to protect critical infrastructure from unauthorized access.
What's Next?¶
Capstone Project 3 — Deploy a Git Server
You'll learn how to:
- Install and configure Git
- Create Git repositories
- Manage SSH-based Git access
- Configure repository permissions
- Secure Git server access
- Enable backups
- Monitor repository services
By the end of the project, you'll have a production-ready Git server that supports secure version control and collaboration for development teams.