How to Access a Remote Server Using a SSH Jump Host?

Introduction

Remote servers, also known as cloud servers or virtual private servers (VPS), are computing machines that are hosted off-site, typically by a third-party provider. They allow for the storage and processing of large amounts of data, and can be accessed from anywhere in the world with an internet connection. Remote servers have become increasingly popular in recent years due to their scalability and cost-effectiveness.

However, accessing a remote server can be challenging due to its distance and lack of direct connectivity to your local network. This is where SSH jump hosts come in: they act as a secure intermediary between your local computer and the remote server, allowing you to access it securely without exposing any sensitive information.

Setting up the SSH Jump Host

SSH jump hosts provide a secure way to access remote servers that are not directly accessible from your local machine. To use a jump host, you must first set it up on a Linux machine and configure it correctly.

Steps to set up a Jump Host on a Linux Machine

To create an SSH jump host on a Linux machine, you will need to follow these steps −

• First, make sure that your Linux machine has OpenSSH installed.

You can do this by running the command `sudo apt-get install openssh-server`.

• Next, navigate to the `/etc/ssh` directory and create a backup copy of the `sshd_config` file using the command `sudo cp sshd_config sshd_config_backup`.

$ cd /etc/ssh/
$ sudo cp sshd_config sshd_config_backup

• Then edit the `sshd_config` file using your preferred text editor (e.g., Nano or Vim). Look for the line that starts with `#Port 22`, remove the # symbol, and change 22 to another port number (e.g., 1234).

• Add these two lines at the end of `sshd_config` −

AllowAgentForwarding yes 
GatewayPorts yes  

• Save and close the file.

• Restart SSH using the command `sudo systemctl restart ssh`.

You now have an SSH jump host setup on your Linux machine.

Explanation of how to Configure the Jump Host's Firewall Settings

Once you have created an SSH jump host on your Linux machine, it is essential to ensure that its firewall settings are correctly configured. To allow access through port 1234 (or whichever port you chose), follow these steps −

• Check if ufw (Uncomplicated Firewall) is installed by running −

sudo apt-get install ufw  

• Allow incoming connections for port 1234 using the command −

sudo ufw allow 1234/tcp  

• Enable the firewall using the command −

sudo ufw enable  

• Verify that your rules have been applied by running −

sudo ufw status numbered  

This will display a numbered list of all your firewall rules, with their corresponding status and ports. By following these steps, you should now have a jump host set up on your Linux machine, with its firewall settings configured correctly.

Configuring the Remote Server for Access via Jump Host

Steps to Configure the Remote Server for Access via Jump Host

Before we can use a jump host to remotely access a server, we need to configure the server so that it will allow connections from our jump host. To do this, we will need to edit the SSH configuration file on the remote server. Firstly, connect to the remote server using SSH with your username and password.

Then open up the SSH configuration file located at /etc/ssh/sshd_config using your preferred text editor. In this configuration file, search for a line that contains "AllowUsers" or "AllowGroups".

If either of these lines is present in the file, add your username or group name after it, separated by a space. Next, search for a line that contains "PermitRootLogin" and set its value to "no".

PermitRootLogin no

This is an important security measure as it ensures that no one can log into your remote server as root directly. Instead, you can use sudo privileges later if you require them.

Save and exit the SSH configuration file by typing ":wq" in Vim or ":x" in Nano. Restart the SSH service on your remote server by running "systemctl restart ssh".

Explanation of How to Add Jump Host's Public Key to Remote Server's Authorized Keys File

The next step is to add our jump host's public key to our remote server's authorized keys file. This will allow us to authenticate ourselves when accessing the remote server through our jump host using SSH.

Firstly, generate an RSA key pair on your local machine if you have not already done so. You can do this by running −

ssh-keygen -t rsa  

After generating your key pair, copy its public key (id_rsa.pub) onto your clipboard using −

pbcopy < ~/.ssh/id_rsa.pub  

Next, connect to the remote server using SSH with your username and password.

Once connected, create a new file within the ~/.ssh directory on the remote server called authorized_keys if it does not already exist. Open this file using your preferred text editor and paste in your jump host's public key by pasting from your clipboard.

Save and exit the authorized_keys file. Now you can close the SSH connection to your remote server and test out accessing it through your jump host.

Connecting to the Remote Server via Jump Host

Steps to Connect to the Remote Server Using SSH and the Jump host as an Intermediary

Once you have set up your jump host and configured your remote server, you can now connect to the remote server using SSH and the jump host as an intermediary. To do this, open a terminal on your local machine and enter the following command −

ssh -J [user@]jump-host [user@]destination-host 

Replace ```[user@]jump-host``` with the username and hostname or IP address of your jump host. Replace ```[user@]destination-host``` with the username, hostname or IP address of your remote server.

Explanation of how to use Port Forwarding With SSH

SSH port forwarding allows you to forward network traffic from one machine to another via an encrypted SSH connection. This can be useful for accessing services running on a remote server that are not directly accessible from your local machine.

To set up port forwarding with SSH, you need to use the `-L` option followed by two arguments separated by a colon. The first argument specifies a port number on your local machine that will be forwarded.

The second argument specifies where network traffic should be forwarded to on the remote machine. For example, if you wanted to forward traffic from port 8080 on your local machine to port 80 on a remote webserver at 192.168.1.100, you could use the following command −

ssh -L 8080:192.168.1.100:80 [user@]jump-host 

This would create an encrypted tunnel between your local machine and the jump host, with traffic forwarded from port 8080 on your local machine being sent over this tunnel and then forwarded onto port 80 of the remote webserver at 192.168.1.100.

Using port forwarding with SSH can be a powerful tool, but it is important to understand the security implications of doing so. Always ensure that you trust the machine you are forwarding traffic to, and consider using additional security measures such as VPNs or firewalls.

Conclusion

In this guide, we discussed how to access a remote server using an SSH jump host. We began by explaining what a remote server is and why it may be necessary to access it.

Next, we introduced the concept of an SSH jump host and explained its purpose. We then provided step-by-step instructions for setting up the SSH jump host on a Linux machine, configuring the remote server for access via the jump host, and connecting to the remote server via the jump host using SSH and port forwarding.