SSH Bastion¶
The Reemo SSH Bastion is a hardened environment, securely exposed through a Reemo session directly in the browser.
This guide first covers deployment (administrator side), then daily usage (end-user side).
Template¶
This template can be imported from the Images page in the administration interface. Refer to the Image import and export section for the import and update procedure.
{"name":"SSH Bastion","type":"ALU","comments":"","reference":"registry.reemo.io/reemosbssh","icon":"<svg width=\"100\" height=\"100\" xmlns=\"http://www.w3.org/2000/svg\" version=\"1.1\">\n\n <g>\n <title>Layer 1</title>\n <path stroke=\"#896ffb\" fill=\"#896ffb\" id=\"svg_1\" d=\"m88.9987,53.00036c0,-6.0664 -4.9336,-11 -11,-11s-11,4.9336 -11,11l0,7l-6,0l0,28l34,0l0,-28l-6,0l0,-7zm-14,0c0,-1.6562 1.3438,-3 3,-3s3,1.3438 3,3l0,7l-6,0l0,-7zm12,27l-18,0l0,-12l18,0l0,12zm8,-56.469l0,16.469l-8,0l0,-16.469c0,-1.9453 -1.582,-3.5312 -3.5312,-3.5312l-66.938,0c-1.9453,0 -3.5312,1.582 -3.5312,3.5312l0,40.941c0,1.9453 1.582,3.5312 3.5312,3.5312l39.469,0l0,8l-39.469,-0.00391c-6.3594,0 -11.531,-5.1719 -11.531,-11.531l0,-40.938c0,-6.3594 5.1719,-11.531 11.531,-11.531l66.941,0c6.3594,0 11.531,5.1719 11.531,11.531l-0.0028,0.00071zm-74.234,27.117l6.2891,-8.6484l-6.2891,-8.6484c-1.3008,-1.7852 -0.90625,-4.2891 0.88281,-5.5859c1.7852,-1.2969 4.2891,-0.90625 5.5859,0.88281l8,11c1.0195,1.4023 1.0195,3.3047 0,4.7031l-8,11c-0.78125,1.0781 -2,1.6484 -3.2383,1.6484c-0.81641,0 -1.6406,-0.25 -2.3477,-0.76562c-1.7852,-1.3008 -2.1797,-3.8008 -0.88281,-5.5859l0.0001,-0.00009zm37.234,2.3516c0,2.2109 -1.7891,4 -4,4l-14,0c-2.2109,0 -4,-1.7891 -4,-4s1.7891,-4 4,-4l14,0c2.2109,0 4,1.7891 4,4z\"/>\n <text id=\"svg_2\" fill=\"#000000\" font-family=\"Arbeit Regular, Helvetica, Arial-Unicode, Arial, Sans-serif\" font-weight=\"bold\" font-size=\"5\" y=\"117.5\" x=\"0\">Created by Mas Dhimas</text>\n <text id=\"svg_3\" fill=\"#000000\" font-family=\"Arbeit Regular, Helvetica, Arial-Unicode, Arial, Sans-serif\" font-weight=\"bold\" font-size=\"5\" y=\"122.5\" x=\"0\">from Noun Project</text>\n </g>\n</svg>","config":[{"conditionOp":"EQUAL","conditionVal":"key","conditionVar":"REEMO_AUTH_METHOD","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":"Paste the full content, including the BEGIN and END headers.","name":"SSH Private Key (PEM)","placeholder":null,"type":"TEXT","uiPriority":940,"value":"","variable":"KEY","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Disabled","placeholder":null,"type":"SELECT_OPTION","uiPriority":10,"value":"false","variable":"REEMO_TASKBAR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Normal (Blocked message)","placeholder":null,"type":"SELECT_OPTION","uiPriority":10,"value":"normal","variable":"REEMO_POLICY_VERBOSITY","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"4","placeholder":null,"type":"SELECT_OPTION","uiPriority":20,"value":"4","variable":"REEMO_SSH_WINDOWS","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":"22","intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"Target Port","placeholder":null,"type":"STRING","uiPriority":990,"value":"","variable":"PORT","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":"vault","intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"Auth Method","placeholder":null,"type":"SELECT","uiPriority":980,"value":"","variable":"REEMO_AUTH_METHOD","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Enabled","placeholder":null,"type":"SELECT_OPTION","uiPriority":20,"value":"true","variable":"REEMO_TASKBAR","optional":false},{"conditionOp":"EQUAL","conditionVal":"filter","conditionVar":"SSH_PROXY_MODE","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":"Allowlist = everything is blocked EXCEPT listed commands. Denylist = everything is allowed EXCEPT listed commands.","name":"Filtering Logic","placeholder":null,"type":"SELECT","uiPriority":840,"value":"","variable":"REEMO_POLICY_MODE","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Allowlist","placeholder":null,"type":"SELECT_OPTION","uiPriority":10,"value":"allowlist","variable":"REEMO_POLICY_MODE","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Dark","placeholder":null,"type":"SELECT_OPTION","uiPriority":50,"value":"#1e1e1e","variable":"REEMO_BACKGROUND_COLOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Denylist","placeholder":null,"type":"SELECT_OPTION","uiPriority":5,"value":"denylist","variable":"REEMO_POLICY_MODE","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Password","placeholder":null,"type":"SELECT_OPTION","uiPriority":5,"value":"password","variable":"REEMO_AUTH_METHOD","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Bypass Mode (No filtering)","placeholder":null,"type":"SELECT_OPTION","uiPriority":5,"value":"interactive","variable":"SSH_PROXY_MODE","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Verbose (Show rule match)","placeholder":null,"type":"SELECT_OPTION","uiPriority":5,"value":"verbose","variable":"REEMO_POLICY_VERBOSITY","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"Target Host IP","placeholder":null,"type":"STRING","uiPriority":1000,"value":"","variable":"IP","optional":false},{"conditionOp":"EQUAL","conditionVal":"allowlist","conditionVar":"REEMO_POLICY_MODE","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":"Comma-separated list (e.g.,ls,pwd,cat).","name":"Allowed Commands","placeholder":null,"type":"STRING","uiPriority":820,"value":"","variable":"REEMO_ALLOW_REGEX","optional":false},{"conditionOp":"EQUAL","conditionVal":"filter","conditionVar":"SSH_PROXY_MODE","defaultValue":"normal","intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"Denial Feedback","placeholder":null,"type":"SELECT","uiPriority":810,"value":"","variable":"REEMO_POLICY_VERBOSITY","optional":false},{"conditionOp":"EQUAL","conditionVal":"password","conditionVar":"REEMO_AUTH_METHOD","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"SSH Password","placeholder":null,"type":"STRING","uiPriority":930,"value":"","variable":"PASSWORD","optional":true},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Black","placeholder":null,"type":"SELECT_OPTION","uiPriority":20,"value":"#000000","variable":"REEMO_BACKGROUND_COLOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"2","placeholder":null,"type":"SELECT_OPTION","uiPriority":40,"value":"2","variable":"REEMO_LIMIT_MONITOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"SSH Private Key","placeholder":null,"type":"SELECT_OPTION","uiPriority":10,"value":"key","variable":"REEMO_AUTH_METHOD","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"3","placeholder":null,"type":"SELECT_OPTION","uiPriority":30,"value":"3","variable":"REEMO_SSH_WINDOWS","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":"filter","intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"Operation Mode","placeholder":null,"type":"SELECT","uiPriority":850,"value":"","variable":"SSH_PROXY_MODE","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Reemo","placeholder":null,"type":"SELECT_OPTION","uiPriority":40,"value":"#896FFB","variable":"REEMO_BACKGROUND_COLOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":"false","intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"Taskbar","placeholder":null,"type":"SELECT","uiPriority":300,"value":"","variable":"REEMO_TASKBAR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Vault","placeholder":null,"type":"SELECT_OPTION","uiPriority":15,"value":"vault","variable":"REEMO_AUTH_METHOD","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":"#1e1e1e","intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"Background Color","placeholder":null,"type":"SELECT","uiPriority":290,"value":"","variable":"REEMO_BACKGROUND_COLOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"1","placeholder":null,"type":"SELECT_OPTION","uiPriority":50,"value":"1","variable":"REEMO_SSH_WINDOWS","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"5","placeholder":null,"type":"SELECT_OPTION","uiPriority":10,"value":"5","variable":"REEMO_SSH_WINDOWS","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Silent (Drop silently)","placeholder":null,"type":"SELECT_OPTION","uiPriority":15,"value":"silent","variable":"REEMO_POLICY_VERBOSITY","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Secure Mode (Filtering active)","placeholder":null,"type":"SELECT_OPTION","uiPriority":10,"value":"filter","variable":"SSH_PROXY_MODE","optional":false},{"conditionOp":"NOTEQUAL","conditionVal":"vault","conditionVar":"REEMO_AUTH_METHOD","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"SSH Username","placeholder":null,"type":"STRING","uiPriority":950,"value":"","variable":"USERNAME","optional":true},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"White","placeholder":null,"type":"SELECT_OPTION","uiPriority":10,"value":"#ffffff","variable":"REEMO_BACKGROUND_COLOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"3","placeholder":null,"type":"SELECT_OPTION","uiPriority":30,"value":"3","variable":"REEMO_LIMIT_MONITOR","optional":false},{"conditionOp":"EQUAL","conditionVal":"denylist","conditionVar":"REEMO_POLICY_MODE","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":"Comma-separated list (e.g.,ls,pwd,cat).","name":"Blocked Commands","placeholder":null,"type":"STRING","uiPriority":830,"value":"","variable":"REEMO_DENY_REGEX","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"2","placeholder":null,"type":"SELECT_OPTION","uiPriority":40,"value":"2","variable":"REEMO_SSH_WINDOWS","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"5","placeholder":null,"type":"SELECT_OPTION","uiPriority":10,"value":"5","variable":"REEMO_LIMIT_MONITOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"Navy","placeholder":null,"type":"SELECT_OPTION","uiPriority":30,"value":"#0a3d62","variable":"REEMO_BACKGROUND_COLOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"1","placeholder":null,"type":"SELECT_OPTION","uiPriority":50,"value":"1","variable":"REEMO_LIMIT_MONITOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":"1","intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"SSH Windows","placeholder":null,"type":"SELECT","uiPriority":360,"value":"","variable":"REEMO_SSH_WINDOWS","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":null,"intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":false,"hint":null,"name":"4","placeholder":null,"type":"SELECT_OPTION","uiPriority":20,"value":"4","variable":"REEMO_LIMIT_MONITOR","optional":false},{"conditionOp":null,"conditionVal":"","conditionVar":"","defaultValue":"5","intMax":null,"intMin":null,"intStep":null,"volumeName":null,"volumeTarget":null,"volumeStorageClass":null,"volumeAccessMode":null,"volumeMode":null,"volumeRequestSize":null,"volumeRequestSizeOverhead":null,"editable":true,"hint":null,"name":"Monitor Limit","placeholder":null,"type":"SELECT","uiPriority":310,"value":"","variable":"REEMO_LIMIT_MONITOR","optional":false}],"links":[],"usePushNotifications":false,"assignableToProvider":true,"os":null,"vmStartMode":null,"vmCreationMode":null,"vmCreationDate":null,"vmPersistentDisk":null,"official":false}
Configuration and Deployment¶
The bastion is deployed via a Reemo template (reemo-template.json) imported into the portal.
Image Information¶
Image:
registry.reemo.io/reemosbssh:latest
Internal Service: SSH Bastion (Rust)
Defining the SSH Target¶
Field |
Description |
|---|---|
Target Host IP |
Address of the remote machine (FQDN accepted). Required. |
Target Port |
Target SSH port. Defaulted to 22. |
Choosing the Authentication Method¶
The Auth Method selector controls the mechanism used by the bastion to authenticate against the remote target.
Option |
Additional Fields |
Behavior |
|---|---|---|
Vault (default) |
— |
The bastion resolves the secret at startup via mTLS against the portal. The Vault natively manages all types of secrets (password, SSH key, key + passphrase). Nothing is written to disk. Preferred method. |
SSH Private Key |
SSH Username + SSH Private Key (PEM) |
Authentication by private key. Paste the complete PEM, including BEGIN/END headers. The key remains in memory within the process. To be avoided. |
Password |
SSH Username + SSH Password |
Authentication by password. The password remains as a process environment variable. To be avoided. |
Tip
Interactive Prompt (JIT): If the chosen authentication method is Password and the password field (or username/password pair) is left blank in the form, the bastion will request them dynamically and silently from the end user within the terminal.
Selecting the Operation Mode¶
The Operation Mode selector determines whether the bastion applies restrictions or acts as a transparent relay.
Option |
Behavior |
|---|---|
Secure Mode (Filtering active) (default) |
Every command passes through the parsing engine. Local line editing, history, and security policy enforcement. |
Bypass Mode (No filtering) |
The bastion relays end-to-end (PTY passthrough). No filtering is active. |
Managing the Filtering Logic¶
The Filtering Logic selector is only visible in Secure Mode.
Option |
Semantics |
|---|---|
Denylist |
Everything is allowed except for commands listed in Blocked Commands. |
Allowlist |
Everything is forbidden except for commands listed in Allowed Commands. |
Both fields accept a comma-separated list of commands (e.g., ls,pwd,cat). The * suffix at the end of a command allows covering all its variants: mkfs* covers mkfs.ext4, mkfs.btrfs, etc.
Warning
Always Blocked Commands (No Exceptions): Interpreters (bash, python, perl…), debuggers (gdb, strace, ltrace), interactive editors (vim, nano, emacs, vi), dangerous arguments (–no-preserve-root, /dev/sd*, /etc/shadow…), and critical redirections (>/etc/shadow, >/proc/*…) are systematically blocked by the security engine, regardless of your configuration.
Customizing User Feedback¶
The Denial Feedback selector (visible only in filtered mode) controls what the end user sees when a command is rejected.
Option |
End-User Display |
|---|---|
Silent (Drop silently) |
No message. The command is silently dropped. |
Normal (Blocked message) (default) |
[reemo] command blocked by policy |
Verbose (Show rule match) |
[reemo] blocked - <rule> : <detail> (e.g., denylist: ‘rm’ matches deny pattern). |
User Guide¶
Within a Reemo session, interaction with the bastion takes place directly from your browser’s terminal interface.
Connecting¶
Two scenarios arise when the session opens:
Complete Configuration: The remote target machine prompt appears immediately.
Dynamic Authentication: The bastion prompts you for your credentials on the fly:
[reemo] Remote username: _ [reemo] Remote password: _
Enter the information and press Enter. Password input is completely hidden (no characters are displayed).
Interpreting the [reemo] Visual Cue¶
All communications originating from the bastion (and not from the target machine) are prefixed with the `[reemo]` tag. The color of this tag indicates the nature of the information:
🟣 Purple: Prompt, general information message, transfer progress.
🟢 Green: Success of an operation (e.g., transfer completed).
🔴 Red: System error, command blocked by security policy, disconnection.
Managing the Terminal and History¶
Key / Shortcut |
Action |
|---|---|
← / → |
Move the cursor within the command line. |
Home / End |
Place the cursor at the beginning or end of the line. |
Backspace / Delete |
Delete the character to the left of or under the cursor. |
↑ / ↓ |
Navigate the history (last 100 commands of the session). |
Enter |
Validate and submit the command to the security filter. |
Ctrl+C |
Interrupt the current command entry. |
Shift+Ctrl+C |
Copy selected text to the clipboard. |
Shift+Ctrl+V |
Paste clipboard content. |
Left click (selection) |
Automatically copies highlighted text. |
Middle-click |
Pastes the automatic selection. |
Screen Scrolling |
Speed |
|---|---|
Mouse wheel |
Normal scrolling (3 lines per notch). |
Shift + Mouse wheel |
Precision scrolling (1 line per notch). |
Ctrl + Mouse wheel |
Fast scrolling (page by page). |
Transferring Files¶
The bastion exposes a local directory named ~/Transfer, accessible from the Files menu of the Reemo browser. This directory acts as a buffer zone between your workstation and the remote target machine.
Three dedicated commands are available in the terminal (they are natively intercepted by the bastion; no component is required on the target machine):
Command |
Effect |
|---|---|
reemo-list |
Lists the contents of the ~/Transfer directory. |
reemo-put <file> [target-path] |
Sends a file from ~/Transfer to the target machine. |
reemo-get <target-path> |
Retrieves a file from the target machine to ~/Transfer. |
1. Inventorying the Directory with `reemo-list`
Displays the buffer zone contents with file sizes and dates:
[reemo] transfer directory contents:
FILE 1.2 MB 05-05-2026 14:22 rapport.pdf
FILE 4.8 KB 05-05-2026 14:25 notes.txt
───────────────────────────────────────────────────────
Total: 2 files ( 1.2 MB )
2. Sending to the Target with `reemo-put`
Uploads a file from ~/Transfer to the remote machine. If no path is specified, the file is dropped into the remote user’s $HOME directory.
$ reemo-put rapport.pdf
[reemo] uploading rapport.pdf ■■■■■■■■■■■■□□□□□□□□ 60% | 8.2 MB/s | ETA: 1s
[reemo] ✔ upload OK: rapport.pdf (1.2 MB) in 2.0s (6.0 MB/s)
To specify another destination:
$ reemo-put rapport.pdf /tmp/rapport.pdf
Note
The destination path must include the final filename. Targeting a raw folder (e.g., /tmp/) will trigger a system error.
3. Retrieving from the Target with `reemo-get`
Downloads a file from the target to ~/Transfer, allowing you to then download it to your local machine via the Reemo browser menu.
$ reemo-get /var/log/audit.log
[reemo] downloading audit.log ■■■■■■■■■■■■■■■■■■■■ 100% | 3.4 MB/s | ETA: 0s
[reemo] ✔ download OK: audit.log (820.4 KB) in 0.2s (3.3 MB/s)
The file inherits its original name (audit.log). If a file with the same name already exists in ~/Transfer, it is overwritten without warning.
Warning
The ~/Transfer space is strictly private and ephemeral. Remember to transfer your files back to your local machine before closing your Reemo session, as data does not survive a container stop.
Security Constraints¶
No interactive editors: In secure mode (Secure Mode), access to vim, vi, nano, emacs, or pico is blocked to prevent the opening of escape sub-shells (e.g., :!sh). To modify a document, use non-interactive commands (sed, tee, cat) or perform the modification locally before using reemo-put.
No complex sub-shells: Syntaxes like echo $(date) or `whoami` are rejected by the parsing engine. Break down your actions by executing commands sequentially. Simple redirections via pipelines (cmd1 | cmd2) remain allowed.
No automatic Tab completion: In secure mode, the command is only analyzed when the Enter key is pressed. Therefore, the Tab key is not interpreted. Completion remains operational only in Bypass Mode.
No transfer commands in Bypass Mode: In bypass mode, the bastion acts as a raw PTY relay to allow interactive editors. Consequently, the reemo-put, reemo-get, and reemo-list commands are unavailable in this mode.
Changelog - SSH Bastion Image¶
v1.0.0 (2026-06-23)¶
First public release of the SSH Bastion Reemo image: a hardened SSH jump host that filters and audits commands before relaying them to a target server, delivered through a Reemo browser session.
Added¶
Filtered SSH bastion in the browser. Operators reach a target server through a man-in-the-middle proxy that inspects every command before it is forwarded. No SSH client, key or open port is exposed to the end user.
Command filtering with policy modes. Each command is parsed and checked against an allowlist or a denylist of regular expressions, with a fail-closed rule: anything that cannot be safely interpreted is rejected.
Always-on safety guardrails. Interpreters and debuggers (
bash,python,eval,exec, …) are blocked regardless of configuration, as are dangerous arguments and writes to sensitive system files.Secure file transfer. Optional
reemo-list/reemo-put/reemo-getcommands move files to and from the target with a real-time progress display, and can be disabled entirely per deployment.Centralized credential management. Optional integration with the Reemo credential portal: target credentials are resolved at session start and kept in memory only — never written to disk.
Multi-monitor desktop. The remote session can use several screens, added or removed on the fly during the session, and resizes dynamically to the browser window.
Multi-window sessions. Up to five terminal windows can be opened automatically when the session starts; more can be opened at any time during the session. Each window is an independent filtered session to the same target.
Configurable taskbar and desktop background. An optional persistent taskbar manages open windows, and the session background color is configurable.
Unified audit logging across all subsystems, with per-line Reemo user attribution, making it straightforward to correlate commands and events with a specific session.
Versions - SSH Bastion Image¶
Images published on registry.reemo.io/reemosbssh.
Each build exposes these pullable tags:
Latest (
:latest) – the latest published releaseRelease (
:vX.Y.Z) – always tracks the latest build of this versionBuild (
:vX.Y.Z-N) – a specific, frozen weekly buildImage (
:<id>) – immutable reference to this exact build
Example: docker pull registry.reemo.io/reemosbssh:vX.Y.Z-N
v1.0.0-1 (2026-06-23)