<p>I assume your users connect to the gateway with ssh (possibly with additional credentials like a hardware-generated one-time-password), and then jump to the actual servers with a second ssh connection.</p>

<p>In itself, this is fine (and the usual thing that's done regularly by companies I've worked with). The secondary ssh connection (still) takes care of only letting those people in who are authorized. The job of the gateway is primarily to avoid the need for the ssh port of the servers to be open to the internet on the network level.</p>

<p>Obviously, you want to avoid people opening ssh tunnels, using proper settings in your global ssh/sshd configuration, and you will want to tighten down the gateway itself (for example, by having read-only home directories for your incoming users; and having no tools installed that can help in somehow bypassing any of your rules - i.e., no telnet, netcat and so on; ideally a chroot environment in which nothing except the <code>ssh</code> executable is available).</p>

CC BY-SA 4.0
2018-07-12T06:01:53.523Z
2018-07-12T06:21:19.197Z
2018-07-12T06:21:19.197Z
AnoE
<p>I have started at a new company and am in the process of locking down SSH access to be through a single SSH gateway server.</p>

<p>My question is, should I create a separate SSH gateway server for each environment? (QA, Dev, Stage, Prod)</p>

<p>We are fully in AWS so my current plan is to create an SSH Gateway server on a DevOps VPC and create peer connections to the QA/Dev/Stage/Prod VPCs.</p>

<p>Then I would manage access to environments via SSH keys.</p>

<p>My concern is that this single SSH gateway server has access to all environments, which is a little terrifying. But that being said, it is easier to manage and monitor access.</p>

<amazon-web-services><security>
Bad practice having a single SSH gateway with access to all environments?
MrScripter
# Bad practice having a single SSH gateway with access to all environments?

(Asked by: username_0 on 2018-07-11)

I have started at a new company and am in the process of locking down SSH access to be through a single SSH gateway server.

My question is, should I create a separate SSH gateway server for each environment? (QA, Dev, Stage, Prod)

We are fully in AWS so my current plan is to create an SSH Gateway server on a DevOps VPC and create peer connections to the QA/Dev/Stage/Prod VPCs.

Then I would manage access to environments via SSH keys.

My concern is that this single SSH gateway server has access to all environments, which is a little terrifying. But that being said, it is easier to manage and monitor access.

**Tags:** amazon-web-services, security


---

## 1 answers

### Answer by username_1 on 2018-07-12. Score: 1

I assume your users connect to the gateway with ssh (possibly with additional credentials like a hardware-generated one-time-password), and then jump to the actual servers with a second ssh connection.

In itself, this is fine (and the usual thing that's done regularly by companies I've worked with). The secondary ssh connection (still) takes care of only letting those people in who are authorized. The job of the gateway is primarily to avoid the need for the ssh port of the servers to be open to the internet on the network level.

Obviously, you want to avoid people opening ssh tunnels, using proper settings in your global ssh/sshd configuration, and you will want to tighten down the gateway itself (for example, by having read-only home directories for your incoming users; and having no tools installed that can help in somehow bypassing any of your rules - i.e., no telnet, netcat and so on; ideally a chroot environment in which nothing except the `ssh` executable is available).


---

