8i | 9i | 10g | 11g | 12c | 13c | 18c | 19c | 21c | Misc | PL/SQL | SQL | RAC | WebLogic | Linux

Home » Articles » Vm » Here

Oracle Cloud Infrastructure (OCI) : Create a Bastion

This article shows how to create a bastion under Oracle Cloud Infrastructure (OCI).

The screens change a little with each quarterly release of Oracle Cloud. Even so, the screen shots in this article will give you a good idea of what is involved.

Related articles.

What is a Bastion?

Allowing direct connections to cloud services and resources can present a security risk, especially as the number of resources grow over time. To solve this, some people use a small virtual machine inside the virtual cloud network and make connections to all the cloud services from that VM. This reduces the number of services exposed to the outside world, whilst still allowing connections for developers and administrators. We can consider a small VM like this to be a manual version of a bastion, or a jump-box.

An alternative to creating a manual bastion is to use an Oracle Cloud Infrastructure (OCI) Bastion. This article shows how to create a bastion under Oracle Cloud Infrastructure (OCI).

Before we move on, here are some assumptions.

Create a Bastion

Log into the Oracle Cloud. Click on the hamburger menu at the top-left of the screen.

Oracle Cloud Infrastructure : Console

On the menu select "Identity & Security > Bastion".

Oracle Cloud Infrastructure : Menu

Select the compartment and click the "Create bastion" button.

Oracle Cloud Infrastructure : Bastions

Enter the bastion name and select the VCN and subnet for the bastion. We need to enter a CIDR block allowlist. In this case I've used the subnet for my IP address from my internet service provider. Click the "Create bastion" button.

Oracle Cloud Infrastructure : Create Bastion

Wait while the bastion is provisioned.

Oracle Cloud Infrastructure : Bastions

Once the bastion is created, click on the link.

Oracle Cloud Infrastructure : Bastions

Click on the "Create session" button.

Oracle Cloud Infrastructure : Bastion Details

Select the type of session. In this case we used "SSH port forwarding session". Give the session a name, or accept the default name. Select the destination IP/Instance and port. Upload a private key to be used for the connection. Click the "Create session" button.

Oracle Cloud Infrastructure : Bastion Create Session

Click on the kebab menu on the right of the new session.

Oracle Cloud Infrastructure : Bastions

Click on the "Copy SSH command" option and paste the resulting text into an editor. We'll use it later.

Oracle Cloud Infrastructure : Bastions Copy

Connect Using A Bastion

The connection details we copied previously will look something like this.

ssh -i  -N -L :10.0.1.156:22 -p 22 ocid1.bastionsession.oc1.uk-london-1.amaa...3acq@host.bastion.uk-london-1.oci.oraclecloud.com

We use our private key and in this example I chose port 9022 for the local port to create the tunnel.

ssh -i ./myOracleCloudKey -N -L 9022:10.0.1.156:22 -p 22 ocid1.bastionsession.oc1.uk-london-1.amaa...3acq@host.bastion.uk-london-1.oci.oraclecloud.com

We can now make a connection to the destination server through the bastion using our tunnel.

ssh -i ./myOracleCloudKey opc@localhost -p 9022

Thoughts

Here are some thoughts about the current implementation of the Oracle Cloud Infrastructure (OCI) Bastion.

For more information see:

Hope this helps. Regards Tim...

Back to the Top.