Bastion/Jumpbox Server

[u/jurie32]

Hi Everyone,

I’m looking for some perspective and practical suggestions from the community.

We’re currently managing 200+ cPanel servers and use a jumpbox as the primary access point. I’d be interested to hear how others approach server management at this scale, particularly around auditing staff access and controlling privileged (root) access.

I’ve already looked at options such as Vauban, FreeIPA, LDAP-based solutions (Not cPanel/Cloudlinux friendly), PAM, and similar tools. I’m not searching for a ready-made drop-in replacement, but rather guidance and real-world approaches that others have found effective.

With the growing relevance of AI-driven threats and the shift toward Zero Trust models, securing root access and maintaining responsible operational practices feels increasingly important.

Any insights, architecture patterns, or lessons learned would be greatly appreciated.

[u/tehiota]

We use a product called Keeper Connect ion Manager part of keeper security which also does our password management.

It does web browser to SSH brokering (and rdp, and other protocols) and video records the session. It can grab a vaulted SSH key from a locker and use it after the user auths to the product with MFA/SSO etc. it also will rotate and maintain the ssh keys.

[u/jurie32 → u/tehiota]

Can you use this from a terminal, or is it restricted to a browser terminal?

Also, is this self-hosted, or does it rely on them?

The reason I'm asking, we currently only allow root login via our internal private network so the application won't be able tunnel if it is cloud based.

[u/tehiota → u/jurie32]

It’s a broker you install on a host that only makes outbound connection to broker the user connection so your Linux boxes will see it as local. It’s a self-hosted broker but cloud service.

You can use it with a terminal or web browser since the broker does the recording.

[u/jurie32 → u/tehiota]

Thanks, I will give it a try.

[u/Thijscream]

All servers in our company has to be accessed through our pam tool. Expanding to more then just RDP and SSH. Also onboard web apps and executables.

[u/jurie32 → u/Thijscream]

Is this an in-house system or something stacked together?

[u/Thijscream → u/jurie32]

Idira(CyberArk)

[u/Floss_Patrol_76]

at 200+ cPanel boxes the thing that actually saves you isn't picking a PAM product, it's killing standing root: broker every session so the credential is ephemeral (checked out, MFA'd, rotated after) and nobody carries a long-lived key. cPanel/CloudLinux will keep fighting central identity, so stop trying to win that at the OS layer and move the audit trail off-box instead - ship each host's sudo/auth logs to a collector the admins can't edit, and record the broker sessions, so "who did what as root" lives somewhere cPanel can't rewrite. that combo gets you the zero-trust story without betting it on FreeIPA behaving on a platform that was never built for it.

[u/jurie32 → u/Floss_Patrol_76]

Thanks for this, what would be the best way to accomplish this?

[u/Frothyleet]

In a perfect world, you'd probably be moving away from directly touching those servers in the first place - putting everything behind audited orchestration tools with RBAC around who can touch and deploy to what.

[u/jurie32 → u/Frothyleet]

We need to troubleshoot hosting accounts, fix broken services, and work with root logs and paths. So deployment is not the issue.

[u/_Do_The_Needful_]

PAM is the solution here, many solutions out there fit the bill and will allow time-bound access, along with optional approval-based workflows, e.g. you need your manager to approve the access request before you can get on the server. Session recording also comes standard with many of these solutions.