WHAT IS A BASTION HOST? HOW TO USE BASTION HOSTS? Simplified and Visualized

[@pritomdasradheshyam2154]

This is by far so much intuitive explanation for Bastion Hosts, thankyou so much for working on this, this kind of stuff takes so much energy and time, I am so happy that you chose to open source these kind of great content in KZbin!

[@PracticalLearningDataHub-ql5wg]

Great Video. Visualizations are the best way to understand the basics and Hands-on Demonstrations makes great sense to a learner. The best way to teach rather than following the traditional conceptual teaching. I appreciate your work. Keep them coming. All the best.

[@aniketfadia7328]

This explanation is so easy to understand! :) Thanks for the video and for putting so much effort into the visuals! :) Great work mate, keep going! :)

[@Pythoholic]

Thanks 👍

[@harshchitroda]

One of the most informative and clear video on Bastion Hosts, keep uploading.

[@ajmirshowraf5556]

তকতলতি

[@prerakmer455]

Perfect video to understand bastion host. Simple and easy to understand explanation. Thank you!!!!!

[@cassandraz3035]

You are so good at what you do ! Thank you for your time

[@somesh6090]

A very deep learning video about bastion host with much less time.

[@ceaconcept3663]

you just earned my subscription! great job!!

[@chintalapativenkataramarahul]

Thanks for the visual demonstration of a bastion. That made it easier to grasp the concept.

[@Shanmugasudhan]

Thanks for the grt explanation !!

[@satyaswarupswain]

Your teaching skill is superb bro .

[@SJ-fj6oe]

You SHOULD NOT have Enabled Auto Assign Public IP for Bastion Host (3:56 sec of the video). It's recommended to disable it. Also why did you allow outside world (0.0.0.0/0) in your Bastion Host Security Group. The bastion host that you just created SHOULD NOT be reached from the internet. Rather choose ELASTIC IP that are allowed from ON PREM Firewalls. Allocate an Elastic IP address, and make it reachable from the internet over IPv4 by associating it with your bastion host

[@Pythoholic]

I understand that completely. It is just an experiment to show the concept not the actual implementation. but I will do one video with they way u have pointed out as well. Thanks for the feedback. If you dint like the video, please make sure you put a dislike. Hoping you might have already done that.

[@619trading9]

According to Aws - best practice is not to copy the file to the bastion host but to use ssh agent forwarding...do you have a tutorial for that?

[@Pythoholic]

I haven't created that yet.

[@JohnKabler]

Excellent production quality and content. Really loved the use of the battle visual. Well done, sir.

[@Pythoholic]

Thanks a lot :)

[@pvenugopal2809]

wow... wonderful session and your way of presentation is simply super, pls keep it forward

[@ishaanme91]

Clear and concise. Awesome!

[@kishanpatro45]

I can connect my private host server from bastion host but am unable to push the file, what could be the reason?

[@GuitarreroDaniel]

This was extremely useful. Thank you very much!

[@rakesh.g9999]

Thanks ....it was really easy....u made it

[@thelazychewresearch]

Great video!

[@tsukinosukee]

copying the "pem" file into bastion host good practice? should we use ssh agent instead? ssh-add -K myPrivateKey.pem

[@Pythoholic]

Yeah that's the way we should do it in prod. This was just a simple way. Most are not aware of how SSH works. So need to.keep it simple

[@smiley2827]

It will be interesting if you will discuss about real use case.

[@MARK01986]

Could you please show the config of your vpc-demo?

[@winfle]

instead of copyring you ssh keys to bastion, you can use SSH key agent forewarding

[@IamOnlyaHumanafterall]

Are bastion hosts used only for linux instances or other OS instances as well ?

[@Pythoholic]

Its for both, depends on what port you allow. SSH or RDP

[@Isingbadbutiamaswiftie]

Thank you so much for this explanation 🙏

[@nerdy-zeig7774]

So... its just a cloud version of a jump server?

[@bbstriker]

Thank you firvtge video. Very clear. Why would we need a bastion host if we can instead use AWS Sessions Manager (SSM)?

[@Pythoholic]

Yes its coming up . Thanks for the feedback

[@akshigoel348]

Can anyone please help me to understand the difference in accessing private instance at 9:36 from the previous one. Why access is not possible, i.e. what is the different from previous accessing. Thank you.

[@Pythoholic]

The basic difference is you allow access from a single point of host ie your bastion. Cause ur security group allows from only that. Direct access to host b is not possible . If you have to access it you need to go though the bastion

[@akshigoel348]

@@Pythoholic thanks for quick help!! 👍

[@charlottenkwah8642]

wooow this is really good but i think you were too fast with the explanation and the demo. But nice work

[@PaulEllisBIGDATA]

Outstanding video

[@hebronspiritualmessages9382]

Thanks for the well explanation. i have one doubt here as im new to AWS... when we are able to connect Private instances which are in private subnets via bastion host then what is the need of NAT gateway and NAT instance.. ? simple we are allowing bastion IP in Private instance SG and connecting from bastion host to private instance. which is easier than deploying NAT gate and NAT instance... could pls explain .. Thanks in advance.

[@Pythoholic]

NAT gateways are special cases where if you need to allow public internet access to your private instances. But that doesn't mean others have access to the machine or even SSH access to that machine. Let suppose you just want to install Centos updates and you need public internet access then it can work without allowing SSH access to that machine. And later it can be removed from the rule set to make it secure again.

[@Pythoholic]

Bastion is a totally separate concept. The instances behind bastion may or may not need public internet access. It's just a additional security to have a bypass to the instances that you want to securely access

[@fftu4741]

If I want to build a website, should the website be placed in an instance of a private subnet? How to configure the private subnet ‎Apache? My problem now is that the instance of the private subnet can't connect to the network and configure the Apache environment. Please help me answer, thank you

[@Pythoholic]

If u wish to build a website make it public but ensure you have a DNS name SSL certificate and only access through URL and not with ip

[@fftu4741]

@@Pythoholic Okay, I understand this. However, after creating a bastion host and a private instance in the video, how to install Apache in the private instance?now, the private instance Unable to install Apache online

[@Pythoholic]

You can have ur NAT connected to your private instance else you need to have ports opened specific for that purpose else you need to create application specific Ami

[@ramkowsu5295]

Wonderful explanation

[@diptybates765]

I am getting this error : Permission denied (publickey,gssapi-keyex,gssapi-with-mic). is there any way to resolve this issue ? When I tried to connect Private Instance via the Public instance. Thank you .

[@Pythoholic]

please change the key permissions

[@Pythoholic]

chmod 400 keyname

[@diptybates765]

@@Pythoholic Thank you so much, it is working now. 😊

[@berndeckenfels]

Don’t copy keys to the bastion host, it’s a bit more secure to use ssh agent forwarding (but in permission ask mode). And also it need more hardening like session locks, retry, egress filtering and so on

[@Pythoholic]

Yes it's just a example . In real time we shouldn't do that

[@AsheeshKum]

Any way we can access from my desktop thru internet to private subnet linux machine VNC server GUI via bastion windows machine... ANY HELP is APPRECIATED.

[@Pythoholic]

Yeah if you are able to create a tunnel and pass the proxy information while connecting to the UI. Check for server connection settings

[@amulyamb7331]

Sir we need a project on this will you do our final year project??

[@Pythoholic]

That's impressive, sorry i cant be a part but if you need some suggestions you can let me know.

[@vm5304]

thank you. I tried to read the letters on your screen, but they are blurred. Can you make the font clearer?

[@Pythoholic]

Hi thanks for the feedback, if you could please point out the timestamp or share a screenshot at the discord..it will be really helpful

[@vm5304]

@@Pythoholic all the white screens such as the AWS console and Windows are not clear. For example from 3.22 to 7.4 Thank you so much I found your videos very helpful for Sol. Arch. Ass. certificate. Can you sort or tag the videos by 1. Design Resilient Architecture 2. Define Performant Solution 3. Specify Secure Applications & Architectures 4. Design Cost-Optimized Architectures

[@Pythoholic]

Please login to www.pythoholic.com and there u can see the list of all videos with proper tags in place

[@vm5304]

@@Pythoholic Thank you!

[@kaustuvprajapati4174]

which tool is used to create slides?

[@Pythoholic]

Just ppt 👍

[@andriys5772]

Thank you!

[@cpetester1698]

Bhai can you make something for Transit VPC ?

[@Pythoholic]

Sure i will make a note of it. Thanks

[@LucasBhata]

top explanation, ta

[@dianeconrardy829]

Great information, but pace of delivery was a little to fast to me...

[@Pythoholic]

Sure Diane will keep that in mind

[@i-am-administrator]

you didnt mention in which VPC you deployed this baston host and priviate host. as far i know if both share the same VPC they can communicate with what SG rules given to them. i such case you showed us it is not possibale from another pubilc host but i doubt this from different VPC so it wont communicate . if public host is part of same VPC then it will also gets commuicated with the help of baston host.

[@Pythoholic]

Great observation and I echo this but this was a simple explanation on bastion but if we want to actually create a bastion host it would need steps that beginners might have a issue understanding. I am currently working on a video that is more aligned with new steps. I hope that would solve this.

[@i-am-administrator]

waiting for that video. cheer to your efforts@@Pythoholic

[@AliTwaij]

thankyou

[@James-sc1lz]

I think your parrot likes Bastion

[@Pythoholic]

hahaha damn that true !!

[@21cse121sahukarisaikiran-h]

U have to explain with mouse otherwise how we get know what u r explaining

[@Pythoholic]

Thanks for feedback i will incorporate thag

[@KAcreation031]

Hi Ec2-key.pem, is this keypair of the instance?

[@Pythoholic]

for the bastion and the instance