What is a bastion host or remote-desktop gateway, and do we need one?

It is a single hardened server that administrators and suppliers must pass through to reach internal systems, instead of connecting to each server directly. Remote sessions end on the bastion, which enforces multi-factor authentication, allows only named accounts, logs or records each session, and is the only host the servers accept administrative connections from. A remote-desktop gateway does the same for remote desktop, wrapping it in an encrypted, authenticated connection. You need one as soon as more than a couple of people, or any supplier, administer your servers remotely, or when SSH or remote desktop would otherwise face the internet. Keep the bastion patched and minimal, with no other software on it. Monitoring then has a simple rule to check: administrative sessions should come from the bastion only. NetSenX flags unusual sessions between hosts as lateral movement, on every plan, so admin traffic that bypasses the bastion stands out.

← All 40 questions on Remote work and exposed servicesAll topics