WarpGate Bastion for SSH, PAM access

Feature
,
1

While Checking Out the latest Release Notes for Termix,

i saw that it now had support for WarpGate warp-tech/warpgate: Fully transparent SSH, HTTPS, MySQL and Postgres bastion/PAM that doesn’t need additional client-side software Which i decided to CheckOut.

WarpGate is a The last bastion. of Secure access / PAM for your internal SSH, HTTPS, MySQL and Postgres servers with SSO and RBAC.
No client apps needed.

Warpgate directly exposes native SSH, HTTPS, MySQL and Postgres listeners, handling Authentication, and then transparently forwards the connection to the target server, while making a live recording for auditing.

You can Then Conect to the target server, using specialised User credentials

image
image501×193 4.19 KB

After configuring, the host server, and ssh

image
image1133×751 91.5 KB

It Even Allows you to use OIDC SSO, for Authentication, meaning you can use any SSO solution, to connect to your servers internally, and offers Audit trail (Authentik supports this natively tough)

image
image1133×751 131 KB

It Should be possible to Implement this in NEthserver 8, through simplified compose file

services:
  warpgate:
    image: ghcr.io/warp-tech/warpgate
    ports:
      - 2222:2222
      - 8888:8888
      - 33306:33306
    volumes:
      - ./data:/data
    stdin_open: true
    tty: true

Then you Would be able to provide even more security, if connecting directly via ssh, or termix, or any other ssh client.

Here are the Nifty Docs for the same Docker - Warpgate

4 Likes
Termix: SSH WebTerminal for Nethserver 8
2

Interesting for tech companies :wink:

1 Like
3

Exactly, Tech companies manage quite a huge number of servers, and sometimes we need to offer limited access to server and resources, or time bound. Managing access becomes a nightmare at times, and might end causing leaks, Due to forgotten credentials issued, that needs to be revoked, etc.

PAM has always been an option, and SSO for SSH, shared with @dan a while back, however, those could be quite complex to setup.

his could even be used, in conjunction with other tools like guacamole, where even the credential given is already limited and tracked, before we get to clients, or for dev scenarios, where they need to ssh directly from their laptops etc.