> For the complete documentation index, see [llms.txt](https://docs.release.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.release.com/guides-and-examples/common-setup-examples/adding-ssh-bastion-access-to-services.md). # SSH bastion access to services Access namespace services like pods or databases for maintenance You can add SSH bastion to an environment to allow team members to securely access resources in the environment, for example, to run utilities accessing backend services like database containers or to perform administrative commands like starting and stopping jobs on private containers not connected to the public internet. {% hint style="danger" %} We do not recommend using bastion access in critical environments, such as staging or production. SSH access is usually unaudited and has elevated powers that could be used to cause harm to your services and environments. Most customers do not need SSH bastion access for their environments. It is a mistake to believe that VPNs and SSH bastions make access to your environments more secure. In reality, these connections may expose your environments to additional risk, and you should keep this in mind if you choose to add SSH bastion access to your application or environment. {% endhint %} ## Create bastion service Navigate to the Application Template settings to create a bastion service that will run an SSH image. This example creates a service for you: ```yaml - name: bastion image: binlab/bastion command: - sh - "-c" - >- cp /var/lib/bastion/public-key /var/lib/bastion/authorized_keys && chmod 600 /var/lib/bastion/authorized_keys && chown bastion:bastion /var/lib/bastion/authorized_keys && bastion ports: - type: node_port target_port: '22' port: '22' loadbalancer: true hostname: bastion-${env_id}-${domain} ``` Let's take a look at these configuration directives: * `name` is the name of the service. * `image` refers to [binlab's public SSH container](https://github.com/binlab/docker-bastion). * `command` provides a series of bash commands that will be run to copy the keys from a known location (keys will be uploaded in the next step) and start the bastion service. * `ports` specifies that the service will listen on port `22`, which is standard for SSH. * `hostname` describes the hostname that will be generated for the bastion service. ## Create and upload public keys to gain access Next we'll use a [just-in-time file mount](/reference-documentation/application-settings/file-mounts.md) to upload the public keys that will be used to access the bastion. Create a text file on your computer called `public-key` with no file extension. Add the list of public SSH keys to this file, placing each key on a new line. An example file with two keys might look like this: ``` ssh-rsa AAAAB3Nza...abcd== User1 ssh-rsa AAAAB3Nza...uvwxyz User2 ``` Now navigate to App Settings and scroll down to the "Just-in-time File Mounts" section. Upload the `public-key` file with the file directory `/var/lib/bastion/` and make sure you select the `bastion` service checkbox. You do not need to select **Secret**, because this file only contains public keys which are not secrets. ![Create the file mount with the public keys and save the file](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-c78ded26c98059b86db472452a3b25be582d750f%2Fjit_file_mount_example.png?alt=media\&token=0efd0f61-3cd0-4790-870c-38f7140173e3) ## Connect to the bastion Once you have applied the services to deploy a new environment or update and existing environment, navigate to the environment's details page. You'll find the hostname for the bastion service in the "Hostname URLs" section. ![](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-e4c0323e6ba4ed494d4d101ccda39815cdc86ea2%2Fenvironment-details-app-import.png?alt=media\&token=dfe1b991-8708-42e4-9d09-0f1580936efe) Copy the hostname for the bastion service. You can now use an SSH terminal to connect as the user `bastion` as follows: ``` $ ssh bastion@bastion-staging-releaseapp.io The authenticity of host 'bastion-staging-releaseapp.io (XX.YY.ZZZ.WWW)' can't be established. ECDSA key fingerprint is SHA256:KKTfemSDp1s. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'bastion-staging-releaseapp.io,XX.YY.ZZZ.WWW' (ECDSA) to the list of known hosts. Welcome to Bastion! bastion-c4dc7-cx:~$ ``` You can now execute commands on the bastion to reach hosts beyond the bastion server. ## Optional: Use the bastion as a jump host The SSH bastion supports a local configuration you can enable to proxy through the bastion transparently. If you would like to learn more using a proxy jump host, take a look at Tecmint's [How to Access a Remote Server Using a Jump Host](https://www.tecmint.com/access-linux-server-using-a-jump-host/). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.release.com/guides-and-examples/common-setup-examples/adding-ssh-bastion-access-to-services.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.