Bastion

Overview

Bastion is the Cloud Temple Bastion service appliance. Deployed within your network, close to your equipment, it forwards SSH and RDP sessions opened from the Cloud Temple console to that equipment via an encrypted, outbound VPN tunnel. Your servers remain invisible from the internet: no incoming traffic, no public IP addresses, and no open ports on the client side.

Key features and benefits:

• Centralised access: establish SSH and RDP sessions with your devices via the Cloud Temple console, without the need for a VPN client on individual workstations.
• Security by design: an encrypted tunnel initiated by the appliance to Cloud Temple, for outbound traffic only.
• Traceability: session logging on the appliance.
• Automatic configuration: the appliance configures itself on first start-up using the information from the console.
• Autonomy: no internet access is required at start-up, apart from the Cloud Temple Bastion service.
• Hardened base system: Ubuntu 24.04 LTS, administrator access via SSH key only, restrictive firewall.
• Update by replacement: each version is an image that has been rebuilt and verified by Cloud Temple.

This Bastion appliance has been pre-configured and optimised by Cloud Temple to simplify deployment within your infrastructure.

How to use

This image is available for OpenIaaS and VM Instances deployments. Availability depends on the features enabled in your environment and the permissions associated with the target. For further details, please see our quick start guide and the Bastion service documentation.

Prerequisites:

• An active subscription to the service Bastion on your tenant. Without it, the appliance cannot be created in the console and the template cannot be brought into service.
• A network on which to deploy the appliance, with access to your equipment. No public IP address is required.

Deployment options:

• Deploy on an OpenIaaS infrastructure

Three-step commissioning:

1. Create the appliance in the console, Bastion menu, page Appliances (/bastion/appliances), the «New appliance» button. The console then displays five configuration values just once : postpone them immediately and keep them until the end of the deployment — they will not be displayed again. Do not store them long-term afterwards.
2. Deploy the virtual machine from this template within your network. The ‘cloud-init’ field on the deployment form is pre-filled using the template below: enter your administrative SSH key and Write down the five values noted in step 1 instead of the <…>, keeping the quotation marks. If your interface does not pre-fill this, paste this template:

#cloud-config hostname: bastion-01 ssh_authorized_keys: -  cloudtemple_bastion: endpoint: "" allowed_ips: "" peer_public_key: "" address: "" private_key: ""

3. Check : The appliance configures itself automatically on first start-up and displays «Operational» in the console within a few seconds. You should then register your devices and log in via SSH or RDP from the console.

Network requirements: Outgoing UDP traffic from the appliance to the address specified via the console; traffic from the appliance to your devices via SSH (22) or RDP (3389).

Support

Cloud Temple guarantees the ability to deploy the template image and the availability of the underlying infrastructure. This includes the ability to instantiate the image in the virtualised environment. As Cloud Temple is the publisher of this appliance, support for its content is provided as part of the Bastion service. This includes, in particular:

• How the appliance works and how it integrates with the console
• The publication of reconstructed and verified images; the appliance is not updated in situ, but is redeployed

The client remains responsible for the equipment managed via the bastion: its configuration, login details and availability.

Terms and conditions

Please consult our General Terms and Conditions of Sale and Use (GTCSU)