Looks like :)

https://github.com/ovh/the-bastion

Though after looking into it more, it seems to me like bastions usually aren't used for reverse proxy / SOCKS like this.

Usually bastions are just allowing one SSH server on your VPC/network and every SSH connection going through it.

I still actually haven't found similar projects to mine.

Bastion SSH? This new-finagle “airgapt” makes GatewayPorts sshd_option setting of OpenSSL kinda useless?

My code review notes says:

  # GatewayPorts specifies whether remote hosts are
  # allowed to connect to ports forwarded for the
  # client.  By default, sshd(8) binds remote port
  # forwardings to the loopback address.  This prevents
  # other remote hosts from connecting to forwarded
  # ports.  GatewayPorts can be used to specify that sshd
  # should allow remote port forwardings to bind to
  # non-loopback addresses, thus allowing other hosts to
  # connect.  The argument may be no to force remote port
  # forwardings to be available to the local host only,
  # yes to force remote port forwardings to bind to the
  # wildcard address, or clientspecified to allow the
  # client to select the address to which the forwarding
  # is bound.
  #
  # CLI option: -o
  # options.fwd_opts.gateway_ports/channel_fwd_bind_addr()/channel_setup_fwd_listener_tcpip()/channel_setup_remote_fwd_listener()
  # options.fwd_opts.gateway_ports/channel_fwd_bind_addr()/channel_setup_fwd_listener_tcpip()/channel_setup_local_fwd_listener()
  # GatewayPorts defaults to 'no'.

You are absolutely correct. I updated to not use GatewayPorts in v0.1.1

Thank you for the feedback!

https://github.com/AkselAllas/airgapt/issues/1

Good suggestion. Added it to the README as an optional addition.

Agreed :) That's why I put it in "quotes"

Can you propose an alternative / more accurate name?

I'd rather not :-)

Naming things is hard. I love the project though, not because I need it, but it proves one of my point: "If you didn't want me to be able to do X, then you shouldn't have allowed SSH access".

Exactly. These "trusted" machines still have security vulnerabilities that you would like to patch though :)

I added MIT license now :)

"Network access" as in outgoing requests to public web.

e.g. you can't curl google.com

I've used this code in CTF competitions and Blue Team exercises where some machines behind a VPN don't have outgoing network access.

(Sometimes it's just simpler to organize this way, sometimes it's deliberate for security purposes.)

So restricted HTTP access, but wide open SSH? Do people commonly restrict only HTTP/HTTPS but leave other ports unrestricted?

This would be a common setup. They allow SSH ingress so that the server can be managed or provisioned with something like Ansible. However, they block all other unused ingress ports, as well as any egress that does not contribute to the function of the server. Also common would be a bastion or VPN to get to the network where SSH is accessible. A mistake is to have SSH accessible to the entire corporate network, which is all too common.

Yeah, well, not only HTTP*, but actually whitelisting whatever outgoing connection you may need. https://github.com/stripe/smokescreen

Suppose you configured your webserver to run with limited privileges so as if someone hacks it it has limited access. Suppose it still has access to DB and stuff. Well, filtering outgoing connections makes harder to exfiltrate the data OR hop to another hosts. And then you can monitor failed outgoing requests to be able to act/investigate when that happens.

Yeah there are a bunch of tools like this - I'm using Aviatrix at the moment for a bunch of hosts:

* Incoming access is allowed to "stuff" when connected to the OpenVPN host.

* Outgoing access to services is very heavily restricted.

* Outgoing HTTP/HTTPS requires the site to be on an allow-list. By default all outgoing HTTP/HTTPS traffic is denied.

(We might add yum-repositories to the allowlist, or permit access to the various "Windows Updates" services, for example. But all other downloads from remote sites would be denied.)

Couldn't an attacker exfiltrate over ssh or over an incoming HTTP connection instead of an outgoing? Or is this a defense-in-depth thing, not meant as a "hard stop"?

I see this as a defense in depth. It can buy you time until attacker figures out how to exfiltrate and you maybe notice via monitoring that something fishy is happening. It also prevents you participating in a DoS or other attacks.

no wide open ssh, it's a machine that can talk to it that can also talk out to the wider internet. (A proxy).

All comments & suggestions / code reviews are welcome!

Usually a bunch of wildly different teams are called "DevOps"

But I found a nice resource to reference where we have 7 "DevOps" team anti-patterns and 9 valid team patterns that people call "DevOps":

https://web.devopstopologies.com/

This article finally gave me a good division about integration tests (stubbed/mocked Cypress or bigger form RTL tests) vs end-to-end tests.