On April 26th, 2012, Bastion was released on the Mac App Store, and is now also available for Mac on Steam via SteamPlay. Operating System: OS X version Leopard 10.5.8, Snow Leopard 10.6.3, or later. Processor: 1.7 GHz Dual Core or Greater. Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses. Provision the service directly in your local or peered virtual network to get support for all the VMs within it.
The concept of bastion hosts is nothing new to computing. Baston hosts are usually public-facing, hardened systems that serve as an entrypoint to systems behind a firewall or other restricted location, and they are especially popular with the rise of cloud computing.
More Linux resources
The ssh command has an easy way to make use of bastion hosts to connect to a remote host with a single command. Instead of first SSHing to the bastion host and then using ssh on the bastion to connect to the remote host, ssh can create the initial and second connections itself by using ProxyJump.
ProxyJump
The ProxyJump, or the -J flag, was introduced in ssh version 7.3. To use it, specify the bastion host to connect through after the -J flag, plus the remote host:
You can also set specific usernames and ports if they differ between the hosts:
The ssh man (or manual) page (man ssh) notes that multiple, comma-separated hostnames can be specified to jump through a series of hosts:
This feature is useful if there are multiple levels of separation between a bastion and the final remote host. For example, a public bastion host giving access to a 'web tier' set of hosts, within which is a further protected 'database tier' group might be accessed.
Hard-coding proxy hosts in ~/.ssh/config
The -J flag provides flexibiltiy for easily specifying proxy and remote hosts as needed, but if a specific bastion host is regularly used to connect to a specific remote host, the ProxyJump configuration can be set in ~/.ssh/config to automatically make the connection to the bastion en-route to the remote host:
Using the example configuration above, when an ssh connection is made like so:
The ssh command first creates a connection to the bastion host bastion-hostname (the host referenced, by nickname, in the remote host’s ProxyJump settings) before connecting to the remote host.
An alternative: Forwarding stdin and stdout
ProxyJump is the simplified way to use a feature that ssh has had for a long time: ProxyCommand. ProxyCommand works by forwarding standard in (stdin) and standard out (stdout) from the remote machine though the proxy or bastion hosts.
The ProxyCommand itself is a specific command used to connect to a remote server—in the case of the earlier example, that would be the manual ssh command used to first connect to the bastion:
The %h:%p arguments to the -W flag above specify to forward standard in and out to the remote host (%h) and the remote host’s port (%p).
ProxyCommand in ~/.ssh/config
As with ProxyJump, ProxyCommand can be set in the ~/.ssh/config file for hosts that always use this configuration:
With this setting in ~/.ssh/config, any ssh connection to the remote host is accomplished by forwarding stdin and stdout through a secure connection from bastion-host.
The ssh command is a powerful tool. While it might mostly be used in its simplest form, ssh user@hostname, there are literally dozens of uses, with flags and configurations to make connections from one host to another. Check out ssh's manual page (man ssh) sometime to discover all of the different options available with this seemingly simple program.
What to read next
FAQs
Do I need a public IP on my virtual machine to connect via Azure Bastion?
No. When you connect to a VM using Azure Bastion, you don't need a public IP on the Azure virtual machine that you are connecting to. The Bastion service will open the RDP/SSH session/connection to your virtual machine over the private IP of your virtual machine, within your virtual network.
Is IPv6 supported?
At this time, IPv6 is not supported. Azure Bastion supports IPv4 only.
Can I use Azure Bastion with Azure Private DNS Zones?
Azure Bastion needs to be able to communicate with certain internal endpoints to successfully connect to target resources. Therefore, you can use Azure Bastion with Azure Private DNS Zones as long as the zone name you select does not overlap with the naming of these internal endpoints. Before you deploy your Azure Bastion resource, please make sure that the host virtual network is not linked to a private DNS zone with the following in the name:
- core.windows.net
- azure.com
Note that if you are using a Private endpoint integrated Azure Private DNS Zone, the recommended DNS zone name for several Azure services overlap with the names listed above. The use of Azure Bastion is not supported with these setups.
The use of Azure Bastion is also not supported with Azure Private DNS Zones in national clouds.
Do I need an RDP or SSH client?
No. You don't need an RDP or SSH client to access the RDP/SSH to your Azure virtual machine in your Azure portal. Use the Azure portal to let you get RDP/SSH access to your virtual machine directly in the browser.
Do I need an agent running in the Azure virtual machine?
No. You don't need to install an agent or any software on your browser or your Azure virtual machine. The Bastion service is agentless and doesn't require any additional software for RDP/SSH.
What features are supported in an RDP session?
At this time, only text copy/paste is supported. Features, such as file copy, are not supported. Feel free to share your feedback about new features on the Azure Bastion Feedback page.
Does Bastion hardening work with AADJ VM extension-joined VMs?
This feature doesn't work with AADJ VM extension-joined machines using Azure AD users. For more information, see Windows Azure VMs and Azure AD.
Which browsers are supported?
The browser must support HTML 5. Use the Microsoft Edge browser or Google Chrome on Windows. For Apple Mac, use Google Chrome browser. Microsoft Edge Chromium is also supported on both Windows and Mac, respectively.
What is the pricing?
For more information, see the pricing page.
Where does Azure Bastion store customer data?
Azure Bastion doesn't move or store customer data out of the region it is deployed in.
Are any roles required to access a virtual machine?
In order to make a connection, the following roles are required:
- Reader role on the virtual machine.
- Reader role on the NIC with private IP of the virtual machine.
- Reader role on the Azure Bastion resource.
- Reader Role on the Virtual Network (Not needed if there is no peered virtual network).
Does Azure Bastion require an RDS CAL for administrative purposes on Azure-hosted VMs?
Bastion New Game Plus
No, access to Windows Server VMs by Azure Bastion does not require an RDS CAL when used solely for administrative purposes.
Bastion Mac Free Download Windows 10
Which keyboard layouts are supported during the Bastion remote session?
Azure Bastion currently supports en-us-qwerty keyboard layout inside the VM. Support for other locales for keyboard layout is work in progress.
Does Azure Bastion support timezone configuration or timezone redirection for target VMs?
Azure Bastion currently does not support timezone redirection and is not timezone configurable.
Is user-defined routing (UDR) supported on an Azure Bastion subnet?
No. UDR is not supported on an Azure Bastion subnet.
For scenarios that include both Azure Bastion and Azure Firewall/Network Virtual Appliance (NVA) in the same virtual network, you don’t need to force traffic from an Azure Bastion subnet to Azure Firewall because the communication between Azure Bastion and your VMs is private. For more information, see Accessing VMs behind Azure Firewall with Bastion.
Can I upgrade from a Basic SKU to a Standard SKU?
Yes. For steps, see Upgrade a SKU. For more information about SKUs, see the Configuration settings article.
Can I downgrade from a Standard SKU to a Basic SKU?
No. Downgrading from a Standard SKU to a Basic SKU is not supported. For more information about SKUs, see the Configuration settings article.
Can I deploy multiple Azure resources in my Azure Bastion subnet?
No. The Azure Bastion subnet (AzureBastionSubnet) is reserved only for the deployment of your Azure Bastion resource.
Why do I get 'Your session has expired' error message before the Bastion session starts?
A session should be initiated only from the Azure portal. Sign in to the Azure portal and begin your session again. If you go to the URL directly from another browser session or tab, this error is expected. It helps ensure that your session is more secure and that the session can be accessed only through the Azure portal.
How do I handle deployment failures?
Review any error messages and raise a support request in the Azure portal as needed. Deployment failures may result from Azure subscription limits, quotas, and constraints. Specifically, customers may encounter a limit on the number of public IP addresses allowed per subscription that causes the Azure Bastion deployment to fail.
How do I incorporate Azure Bastion in my Disaster Recovery plan?
Azure Bastion is deployed within VNets or peered VNets, and is associated to an Azure region. You are responsible for deploying Azure Bastion to a Disaster Recovery (DR) site VNet. In the event of an Azure region failure, perform a failover operation for your VMs to the DR region. Then, use the Azure Bastion host that's deployed in the DR region to connect to the VMs that are now deployed there.
VNet peering
Can I still deploy multiple Bastion hosts across peered virtual networks?
Yes. By default, a user sees the Bastion host that is deployed in the same virtual network in which VM resides. However, in the Connect menu, a user can see multiple Bastion hosts detected across peered networks. They can select the Bastion host that they prefer to use to connect to the VM deployed in the virtual network.
If my peered VNets are deployed in different subscriptions, will connectivity via Bastion work?
Yes, connectivity via Bastion will continue to work for peered VNets across different subscription for a single Tenant. Subscriptions across two different Tenants are not supported. To see Bastion in the Connect drop down menu, the user must select the subs they have access to in Subscription > global subscription.
Does Bastion support connectivity to Azure Virtual Desktop?
No, Bastion connectivity to Azure Virtual Desktop is not supported.
I have access to the peered VNet, but I can't see the VM deployed there.
Make sure the user has read access to both the VM, and the peered VNet. Additionally, check under IAM that the user has read access to following resources:
- Reader role on the virtual machine.
- Reader role on the NIC with private IP of the virtual machine.
- Reader role on the Azure Bastion resource.
- Reader Role on the Virtual Network (Not needed if there is no peered virtual network).
| Permissions | Description | Permission type |
|---|---|---|
| Microsoft.Network/bastionHosts/read | Gets a Bastion Host | Action |
| Microsoft.Network/virtualNetworks/BastionHosts/action | Gets Bastion Host references in a Virtual Network. | Action |
| Microsoft.Network/virtualNetworks/bastionHosts/default/action | Gets Bastion Host references in a Virtual Network. | Action |
| Microsoft.Network/networkInterfaces/read | Gets a network interface definition. | Action |
| Microsoft.Network/networkInterfaces/ipconfigurations/read | Gets a network interface IP configuration definition. | Action |
| Microsoft.Network/virtualNetworks/read | Get the virtual network definition | Action |
| Microsoft.Network/virtualNetworks/subnets/virtualMachines/read | Gets references to all the virtual machines in a virtual network subnet | Action |
| Microsoft.Network/virtualNetworks/virtualMachines/read | Gets references to all the virtual machines in a virtual network | Action |