A bastion host is a special-purpose computer on a network specifically designed and configured to withstand attacks, so named by analogy to the

bastion A bastion is a structure projecting outward from the curtain wall of a fortification, most commonly angular in shape and positioned at the corners of the fort. The fully developed bastion consists of two faces and two flanks, with fire from the ...

, a military fortification. The computer generally hosts a single application or process, for example, a proxy server or

load balancer In computing, load balancing is the process of distributing a set of tasks over a set of resources ''Resource'' refers to all the materials available in our environment which are Technology, technologically accessible, Economics, economically ...

, and all other services are removed or limited to reduce the threat to the computer. It is hardened in this manner primarily due to its location and purpose, which is either on the outside of a

firewall Firewall may refer to: * Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts * Firewall (construction), a barrier inside a building, designed to limit the spre ...

or inside of a demilitarized zone (

DMZ A demilitarized zone (DMZ or DZ) is an area in which treaties or agreements between states, military powers or contending groups forbid military installations, activities, or personnel. A DZ often lies along an established frontier or boundary ...

) and usually involves access from untrusted networks or computers. These computers are also equipped with special networking interfaces to withstand high-bandwidth attacks through the

internet The Internet (or internet) is the Global network, global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a internetworking, network of networks ...

Definitions

The term is generally attributed to a 1990 article discussing firewalls by

Marcus J. Ranum Marcus J. Ranum (born November 5, 1962, in New York City, New York (state), New York, United States) is a computer and network security researcher. He is credited with a number of innovations in Firewall (computing), firewalls, including buildin ...

, who defined a bastion host as "a system identified by the firewall administrator as a critical strong point in the network security. Generally, bastion hosts will have some degree of extra attention paid to their security, may undergo regular audits, and may have modified software". It has also been described as "any computer that is fully exposed to attack by being on the public side of the

, unprotected by a firewall or filtering router. Firewalls and routers, anything that provides perimeter access control security can be considered bastion hosts. Other types of bastion hosts can include web, mail, DNS, and FTP servers. Due to their exposure, a great deal of effort must be put into designing and configuring bastion hosts to minimize the chances of penetration".

Placement

There are two common network configurations that include bastion hosts and their placement. The first requires two firewalls, with bastion hosts sitting between the first "outside world" firewall, and an inside firewall, in a

. Often, smaller networks do not have multiple firewalls, so if only one firewall exists in a network, bastion hosts are commonly placed outside the firewall.

Use cases

Though securing remote access is the main use case of a bastion server, there are a few more use cases of a bastion host such as: * Authentication gateway * VPN alternative * Alternative to internal admin tools * Alternative to file transfers * Alternative way to share resource credentials * Intrusion detection * Software inventory management

Examples

These are several examples of bastion host systems/services: * DNS (Domain Name System) server *

Email Electronic mail (usually shortened to email; alternatively hyphenated e-mail) is a method of transmitting and receiving Digital media, digital messages using electronics, electronic devices over a computer network. It was conceived in the ...

server * FTP (File Transfer Protocol) server * Honeypot * Proxy server * VPN (virtual private network) server *

Web server A web server is computer software and underlying Computer hardware, hardware that accepts requests via Hypertext Transfer Protocol, HTTP (the network protocol created to distribute web content) or its secure variant HTTPS. A user agent, co ...

References

{{Reflist Internet Protocol based network software Computer network security

Definitions

Placement

Use cases

Examples

See also

References