122 lines
5.1 KiB
Markdown
122 lines
5.1 KiB
Markdown
---
|
||
layout: default
|
||
title: Home
|
||
description: An SSH jump host for the theta42 stack — one public host and directory-driven access to every downstream machine you're entitled to; LDAP by default, or fully standalone.
|
||
---
|
||
|
||
# Jump Host
|
||
|
||
An SSH jump host for the [theta42](https://github.com/theta42) self-hosted
|
||
stack. Users SSH into **one** public host and land on any downstream host
|
||
they're entitled to — authenticated against the shared LDAP directory,
|
||
authorized from the [SSO Manager](https://theta42.github.io/sso-manager-node/)'s
|
||
inventory graph, and audited end to end.
|
||
|
||
No per-host accounts, no distributing keys, no VPN. The same people who log in
|
||
to your SSO are the people who can reach your machines — and only the machines
|
||
their directory groups grant.
|
||
|
||
Part of the theta42 self-hosted identity stack, alongside
|
||
[SSO Manager](https://theta42.github.io/sso-manager-node/) and
|
||
[Proxy](https://theta42.github.io/proxy/), composable with one command via
|
||
[theta-env](https://theta42.github.io/theta-env/).
|
||
|
||
## Screenshots
|
||
|
||
<a href="images/login.png" target="_blank"><img src="images/login.png" alt="Login" width="49%"></a>
|
||
<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Dashboard" width="49%"></a>
|
||
<a href="images/sessions.png" target="_blank"><img src="images/sessions.png" alt="Active sessions" width="49%"></a>
|
||
<a href="images/audit.png" target="_blank"><img src="images/audit.png" alt="Audit log" width="49%"></a>
|
||
|
||
*(click any screenshot to view full size)*
|
||
|
||
Don't want to run LDAP or the SSO Manager? **Standalone mode** stores users
|
||
and hosts in a local SQL database instead (SQLite by default, any
|
||
Sequelize-supported dialect if you want something else) — same SSH front door,
|
||
key injection, and audit trail. See
|
||
[Installation](installation.html#standalone-mode) to get started.
|
||
|
||
## Two ways to connect
|
||
|
||
**Direct (WinSCP/SFTP-friendly):**
|
||
|
||
```bash
|
||
ssh alice_-_web01@jump.example.com
|
||
sftp -P 2222 alice_-_web01@jump.example.com
|
||
```
|
||
|
||
The username grammar is `{uid}_-_{target}` — `target` is a directory host slug
|
||
(with or without the `host_` prefix), a bare hostname, or an IP. One username
|
||
string, no interactive step, so it works cleanly in WinSCP and scripts.
|
||
|
||
**Interactive picker:**
|
||
|
||
```bash
|
||
ssh alice@jump.example.com
|
||
```
|
||
|
||
A plain login shows a TUI list of the hosts you can reach; arrow-key or type to
|
||
filter, Enter to connect.
|
||
|
||
See **[Connecting](connecting.html)** for the full usage guide.
|
||
|
||
## Why a jump host (and why this one)
|
||
|
||
A bastion/jump host is the standard way to give SSH access to internal machines
|
||
through a single audited entry point. What's usually painful is *authorization*
|
||
and *credentials*: who may reach which host, and how the bastion authenticates
|
||
onward without you copying keys everywhere.
|
||
|
||
This jump host answers both from your directory:
|
||
|
||
- **Authorization is your directory graph.** The hosts you can reach are the
|
||
union of your LDAP groups × the SSO's inventory (the `host_<name>_access`
|
||
groups the directory already auto-creates). Add someone to a group; they can
|
||
reach the host. No bastion-side allow-list to maintain.
|
||
- **Onward auth is automatic.** The jump host holds one key and injects its
|
||
public half into your `sshPublicKey` on first use, then connects downstream
|
||
**as you**. Downstream hosts already serve keys from LDAP (via
|
||
[ldap-client](https://github.com/theta42/ldap-client)'s
|
||
`AuthorizedKeysCommand`), so nothing downstream needs configuring.
|
||
|
||
## Features
|
||
|
||
- **Username-grammar routing** (`uid_-_target`) — straight-through to the host,
|
||
SFTP included (WinSCP works)
|
||
- **Interactive TUI host picker** on plain login, scoped to your access
|
||
- **LDAP inbound auth** — public key or password (keys-only policy recommended
|
||
for a public host)
|
||
- **Directory-driven access** — reachable hosts come from the SSO inventory, not
|
||
a static list
|
||
- **Per-user key injection** — no downstream changes, no key distribution
|
||
- **Shell, exec, and SFTP** bridging
|
||
- **Web UI + HTTP API** for auditing and metrics — active sessions, a searchable
|
||
audit log, per-user/per-host counters
|
||
- **Full audit trail** — who, target, method, result, bytes, duration, and the
|
||
downstream host-key fingerprint
|
||
- **Standalone mode** — no LDAP, no SSO Manager; users and hosts live in a
|
||
local SQL database (Sequelize, any dialect — SQLite by default)
|
||
- Packaged like the rest of the stack: one-command Docker, idempotent bare-metal
|
||
installer, or bundled in theta-env
|
||
|
||
## Get it
|
||
|
||
```bash
|
||
git clone https://github.com/theta42/jump-host.git
|
||
cd jump-host
|
||
cp secrets.js.example config/jump-secrets.js # then edit it
|
||
docker compose up -d --build
|
||
```
|
||
|
||
That's the standalone quick start. For bare-metal and the bundled theta-env
|
||
option, see **[Installation](installation.html)**.
|
||
|
||
## Related projects
|
||
|
||
- **[SSO Manager](https://theta42.github.io/sso-manager-node/)** — the OpenLDAP
|
||
directory + OIDC provider + the inventory graph this jump host reads.
|
||
- **[Proxy](https://theta42.github.io/proxy/)** — puts your web apps behind the
|
||
same identity; fronts this jump host's web UI.
|
||
- **[theta-env](https://theta42.github.io/theta-env/)** — runs the whole stack,
|
||
jump host included, with one command.
|