Skip to content

Bastion Host Integration

Bastion Host Integration

Configure SSH-KLM to work with traditional bastion hosts and jump servers.

Prerequisites

Bastion host with SSH access
SSH-KLM agent installed on bastion
Network connectivity from bastion to target hosts

Configuration

Step 1: Install Agent on Bastion

curl -fsSL https://get.qcecuring.com/ssh-agent | sudo bash -s -- \
  --server https://ssh-klm.example.com \
  --token YOUR_TOKEN \
  --mode bastion

Step 2: Configure Bastion Mode

agent:
  mode: bastion

bastion:
  enabled: true
  discoverTargets: true
  targetNetworks:
    - 10.0.0.0/8
    - 172.16.0.0/12

  # SSH config for reaching targets
  ssh:
    user: sshklm-scanner
    keyFile: /etc/ssh-klm-agent/scanner_key
    timeout: 30s

Step 3: Add Target Hosts

// Register hosts behind bastion
await client.ssh.addHost({
  hostname: 'internal-server-01',
  port: 22,
  bastion: 'bastion.example.com',
  labels: { environment: 'production' }
});

Discovery Through Bastion

// Discovery uses bastion as proxy
const scan = await client.ssh.startDiscovery({
  hosts: ['internal-*'],
  viaBastion: 'bastion.example.com'
});

Rotation Through Bastion

Key rotation automatically uses the bastion:

await client.ssh.rotateKey({
  keyId: 'KEY-internal-123',
  // Automatically routes through configured bastion
});

Troubleshooting

Cannot Reach Target Hosts

# Test from bastion
ssh -v internal-server-01

# Check agent logs
sudo journalctl -u ssh-klm-agent | grep bastion

Discovery Timeout

Increase timeout for large networks:

bastion:
  ssh:
    timeout: 60s
  discovery:
    parallelHosts: 5