Use AWS Windows instance as an SSH proxy?

[tetris11@lemmy.ml]

My work has given me a remote windows desktop to use, that I access using AWS.

Through this windows desktop (accessed through a chrome web-browser), I can SSH into a compute node to do work.

I dont actually need this virtual desktop, I'd rather just SSH from my local machine directly to the compute node, using the remote desktop's network without having to spawn the desktop itself.

Ive been reading up about SSM agents[0] as a solution, but am unsure if I have the priveledges to do this myself.

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html#ssh-connections-enable

Is this something I can easily do using the AWS credentials that I have?

[strit@lemmy.linuxuserspace.show]

It depends on how the network is setup, I suppose. I don't know how AWS does things, but I would imagine that the Windows Desktop is set to be on the same network/subnet as the compute node you ssh into. Else the node would be accessible by anyone on the internet for brute forcing.

[shareni@programming.dev]

Maybe ask your work before you get fired?

[tetris11@lemmy.ml]

I have, but the IT dept either willfully misinterprets my request, or does not actually know.

My plan is to find a solution that complies with their security standards (i.e. through AWS's authentication spec), but allows me a VPN/SSH style passthrough.

[tetris11@lemmy.ml]

The way I reason it, the Windows Desktop that AWS spawns in done on a Linux-based VM in the cloud. AWS then creates a VPN to the workplace to make it seem like it shares the same subnet as the compute nodes. I think that's how this works.

If so, I'm wondering if I can just SSH either into that VM and access the VPN that way, or if AWS itself offers some kind of service that extends the VPN directly to me.

[deckweiss@lemmy.world]

https://github.com/cea-hpc/sshproxy

Maybe? I saw a presentation from the dev, not sure if it will run on windows though

[max_p@lemmy.max-p.me]

It's going to depend on how the access is set up. It could be set up such that the only way into that network is via that browser thing.

You can always connect to yourself from the Windows machine and tunnel SSH over that, but it's likely you'll hit a firewall or possibly even a TLS MitM box.

Virtual desktops like that are usually used for security, it would be way cheaper and easier to just VPN your workstation in. Everything about this feels like a regulated or certified secure environment like payment processing/bank/government stuff.

[vk6flab@lemmy.radio]

From having played with the remote desktop offering from AWS, it's a Windows Server running a terminal session. It's likely heavily locked down and on its own network with likely no inbound network connectivity.

Similarly, the compute nodes are likely to be locked down to only accept connections from the remote desktop network.

It all depends on what the brief was to whomever set it up.

You might be able to do some shenanigans with the web browser on the remote desktop, but for my money, I'd just open your browser, set it to full screen and forget about how your keystrokes are travelling.

Ultimately, unless you're a shareholder, it's their money.

And for the record, it might be that the IT department doesn't want you to run your own SSH session for a bunch of very good reasons.

[max_p@lemmy.max-p.me]

They could also just be spawning Windows VMs directly in AWS, no point doing nested virtualization for something like this. Pretty sure they have a service for doing exactly what you described. No need for a VPN, it can spawn your VM on the right network already (they call it VPC). They can even put real GPUs for AutoCAD and stuff on those things.

[shareni@programming.dev]

Maybe ask them to provide you with a Linux cli only bastion? Then you've got a lot of options, it costs almost nothing, and even better security wise.

My plan is to find a solution that complies with their security standards (i.e. through AWS's authentication spec)

I think SSO is your best bet, if you use identity center.

[carl_dungeon@lemmy.world]

If they require you to use the bastion, then trying to avoid it is probably a bad idea.

If the bastion is running an ssh server, you can jump through it with ssh pass through (using -J).

SSM provides session manager which allows you to skip having a bastion altogether- it basically lets you start an “ssh” session to a private instance without opening ports or networking using aws creds. This requires that you have access permissions to do this and that ssm is enabled.

But… if the reason you are using the bastion is so that they can inspect the traffic, then they’re not gonna let you bypass it via ssm because that also bypasses the managed networking.