Securely record SSH sessions on RHEL in a private VPC network

On this weblog put up, you’ll learn to document SSH periods on a Crimson Hat Enterprise Linux (RHEL) VSI in a non-public VPC community utilizing in-built packages. The VPC personal community is provisioned by means of Terraform and the RHEL packages are put in utilizing Ansible automation. Moreover, you’ll learn to arrange a extremely accessible bastion host.

What’s session recording and why is it required?

A bastion host and a soar server are each safety mechanisms utilized in community and server environments to regulate and improve safety when connecting to distant methods. They serve related functions however have some variations of their implementation and use circumstances. The bastion host is positioned in entrance of the personal community to take SSH requests from public site visitors and move the request to the downstream machine. Bastion host and soar servers are weak to intrusion as a result of they’re uncovered to public site visitors.

Session recording helps an administrator of a system to audit person SSH periods and ensure they adjust to regulatory necessities. Within the occasion of a safety breach, the administrator will wish to audit and analyze the person periods. That is crucial for a security-sensitive system.

What’s a non-public VPC community?

A virtual private cloud is totally personal if there isn’t any public ingress or outgress community site visitors. In easy technical phrases, it’s personal if there aren’t any public gateways on the subnets (personal subnets) and no floating IPs on the Digital Server Cases (VSIs).

How do I connect with the personal VPC community?

Shopper-to-site VPN for VPC is likely one of the two VPN choices accessible on IBM Cloud, and it permits customers to hook up with IBM Cloud assets by means of safe, encrypted connections.

The client-to-site VPN is extremely accessible, with two VPN servers which can be created in two totally different availability zones in the identical area. The bastions are extremely accessible as nicely.

Conditions

Provision the personal VPC community utilizing Terraform

• After getting the IBM Cloud Secrets Manager secret with the certificates, launch your terminal and set the next Terraform variables:

export TF_VAR_ibmcloud_api_key=<IBM_CLOUD_API_KEY>

export TF_VAR_secrets_manager_certificate_crn=<SECRET_CRN>

git clone https://github.com/VidyasagarMSC/private-vpc-network

cd terraform

• Run the Terraform instructions to provision the VPC assets (e.g., subnets, bastion hosts (VSIs), VPN, and so on.):

terraform init

terraform plan

terraform apply

Hook up with client-to-site VPN

• As soon as the VPC assets are efficiently provisioned, you’ll want to obtain the VPN shopper profile by navigating to VPN servers page on IBM Cloud.
• Click on the Shopper-to-site servers tab after which on the title of the VPN:

• Obtain the profile from the Purchasers tab.
• The VPN provisioned by means of Terraform makes use of certificates. Comply with the instructions here to hook up with the OpenVPN Shopper.
• You must see the profitable connection in your OpenVPN Shopper:

Confirm the SSH connection

• On a terminal, add the SSH personal key to the SSH agent with the next command:

ssh-add <LOCATION_OF_PRIVATE_SSH_KEY> 

• Instance: ssh-add ~/.ssh/<NAME_OF_THE_PRIVATE_KEY>
• Run the next command to SSH into the RHEL VSI by means of a bastion host. You can be utilizing the personal IP handle of the bastion in Zone 1:

ssh -J root@10.10.0.13 root@10.10.128.13

• Bear in mind, you ought to be linked to the client-to-site VPN to entry the RHEL VSI by means of the bastion host.
• After SSH, You must see directions to allow SSH session recording utilizing the TLOG package deal on RHEL.

Deploy session recording utilizing Ansible

To deploy the session recording answer, you’ll want to have the next packages put in on the RHEL VSI:

• tlog
• SSSD
• cockpit-session-recording

The packages will probably be put in by means of Ansible automation on all of the VSIs—each bastion hosts and RHEL VSI.

Related articles

Monetum improves its profile with the acquisition of Upbots/SuperBots for its algorithmic trading utility

October 28, 2024

exSat Network Mainnet Launches with $281M in Liquidity and $BTC Integration

October 28, 2024

• Transfer to the Ansible folder:

cd ansible

• Create hosts.ini from the template file:

cp hosts_template.ini hosts.ini

• Run the Ansible playbook to put in the packages from an IBM Cloud personal mirror/repository:

ansible-playbook main_playbook.yml -i hosts.ini --flush-cache

You possibly can see in Determine 1 that after you SSH into the RHEL machine, you will note a notice saying: ATTENTION! Your session is being recorded!

Test the session recordings, logs and reviews

If you happen to intently observe the messages post-SSH, you will note a URL to the net console that may be accessed utilizing the machine title or personal IP over port 9090. To permit site visitors on port 9090, within the Terraform code, change the worth of allow_port_9090 variable to true and run terraform apply. The most recent terraform apply will add ACL and safety group guidelines to permit site visitors on port 9090.

• Now, open a browser and navigate to http://10.10.128.13:9090. To entry utilizing the VSI title, you’ll want to arrange a non-public DNS (out of scope for this text). You want a root password to entry the net console:

• Navigate to Session Recording on the left-hand facet to see the listing of session recordings. Together with session recordings, you possibly can verify the logs, diagnostic reviews, and so on.:

Advisable studying

Conclusion

This text coated why session recording is required in bastion hosts for auditing and compliance and the way session recording may be arrange with the built-in RHEL packages utilizing Ansible Automation.

Whereas designing a secured digital personal cloud community, you discovered one of the best practices in architecting a VPC personal community. We additionally coated the necessity to construct extremely accessible VPN servers and bastion hosts. With the provisioning of cloud infrastructure utilizing Terraform and Ansible for session recording, you bought hands-on expertise.

Learn more about IBM Cloud VPC

If in case you have any queries, be happy to achieve out to me on Twitter or on LinkedIn.