4ffb21f9ca
* Update documentation to include RDP in credential injection * Update FAQ on Boundary and Vault integration Fixed typo. * update documentation on credential stores and workflows for RDP * update static credential store documentation to include upd credential creation * update documentation for credential injection setup * Update 'credentials create' command documentation for upd credential type * fixed typo in UPD options * Update create.mdx with instructions for RDP targets * Create rdp-testing-and-compatibility-matrix.mdx * Update rdp-testing-and-compatibility-matrix.mdx * Update rdp-testing-and-compatibility-matrix.mdx * Update to mention ldap secrets engine * Update rdp-testing-and-compatibility-matrix.mdx to get rid of ticket number * updated to include mention of vault kv and chad suggestions Updated with Chad's suggestions and vault kv * Update rdp-testing-and-compatibility-matrix.mdx Found another place where I neglected the vault kv * docs: Style updates * docs: Clean up beta references, adds update commands * docs: Edits, update domain model topics * docs: Add target address caveats * docs: Edit network config section * docs: Use custom port number to connect * docs: Adds anchor link, beta tag * docs: Respond to feedback * docs: Cleanup for consistency, remove known issue * docs: Cleanup and minor fixes * docs: Add link to create issue * docs: Add direct address note to targets CLI topics * Update website/content/docs/concepts/credential-management.mdx Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> * docs: Remove beta references from target and credentials * docs: Remove Vault cred store ID * docs: Remove SSH cert from brokered creds * docs: Remove session recording options * docs: Adds UPD to credential stores domain model topic * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Remove session recording options * docs: Update limitations and configuration * Update website/content/docs/credentials/configure-credential-injection.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Update default port commands * docs: Add known issue for error * docs: Fix typo * Update website/content/docs/credentials/rdp-testing-and-compatibility-matrix.mdx Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * docs: Add certificate acceptance to Windows * docs: Reorder UPD options * docs: Add NTLMV2 to cred management statement * docs: Update Windows Remote Desktop Connection error * docs: Clarify domain behavior * docs: Fix back ticks on command options * docs: Update command format in definition * docs: Clarify port conflict with Remote Desktop app * docs: Update RDP target address caveat * docs: Release notes 0.20.0 * docs: Minor edit * docs: Vercel build * docs: Deletes older important changes --------- Co-authored-by: Dan Rohan <daniel.rohan@elastic.co> Co-authored-by: Dan Rohan <dan.rohan@hashicorp.com> Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
33 lines
2.3 KiB
Plaintext
33 lines
2.3 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Boundary vs. bastion hosts
|
|
description: >-
|
|
Learn how Boundary compares to bastion hosts by providing tightly controlled, just-in-time access to infrastructure using role-based access controls (RBAC).
|
|
---
|
|
|
|
# Boundary vs. bastion hosts
|
|
|
|
If you want to set up your cloud environment securely, you may choose to run all of your important workloads behind a NAT Gateway, and provision a DMZ with a set of hardened bastion servers.
|
|
|
|
Bastion host security groups are often not locked down at the network layer.
|
|
Additionally, users who log into a bastion host using SSH are typically dropped into a privileged account.
|
|
Maintaining security groups, network ACLs, and IAM controls on a bastion host at a per-user level is nearly impossible, unless you create and maintain multiple bastion hosts per user or group.
|
|
IT departments now have to manage updates for another server and the sprawl of infrastructure continues, increasing your attack surface, and requiring your IT department to be perfect.
|
|
|
|
Boundary is not a traditional bastion host.
|
|
Boundary streamlines just-in-time access to privileged sessions for users, and tightly controls access to infrastructure with role-based access controls (RBAC).
|
|
Boundary validates a user's identity using your identity provider of choice, and then dynamically grants them access to the resources they need using their associated permissions.
|
|
Boundary's worker nodes, the resources that proxy connections to private endpoints, are fundamentally stateless and can be easily scaled elastically using modern development tools.
|
|
|
|
You can use SSH or RDP to inject the credentials of any target resources that you want to connect to using Boundary, so that the credentials are never exposed to the user while establishing a connection.
|
|
Alternatively, Boundary can return brokered credentials back to users (if permitted), which could take the form of API tokens, usernames and passwords, public keys, etc.
|
|
|
|
**Can Boundary replace a bastion/jumphost access model?**
|
|
|
|
Yes, in many cases you can use Boundary as a replacement for an existing bastion host-based access model to infrastructure.
|
|
The advantages to Boundary's access model are outlined above.
|
|
|
|
**Can Boundary extend a bastion/jumphost access model?**
|
|
|
|
Yes, some users may see value in Boundary providing access to an existing bastion host deployment.
|