Azure-docs: Can I use bastion from my local SSH client?

[dcuenot]

Hi,

Azure Bastion seems to be very promising!
However, can I use directly my ssh client on my laptop, in order to access to my VMs through the Azure Bastion? Or the only way will be to use the Azure Portal?

If the only way is the Azure Portal, how can I execute my local Terraform or Ansible scripts?

Thanks for your answer.
Regards
Damien

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 196cd28d-c7b6-9e3f-ef55-1c85d6c9be5f
• Version Independent ID: 6daf260e-526d-c5c5-50ca-c7a85e17c78a
• Content: Create an Azure Bastion host
• Content Source: articles/bastion/bastion-create-host-portal.md
• Service: bastion
• GitHub Login: @cherylmc
• Microsoft Alias: cherylmc

[BhargaviAnnadevara-MSFT]

@dcuenot Thanks for the feedback! In order to best address your question, could you provide us with the URL of the MS Doc that you were following, if any?

[dcuenot]

Sure, I'm using this documentation: https://docs.microsoft.com/en-us/azure/bastion/bastion-create-host-portal

[BhargaviAnnadevara-MSFT]

@dcuenot Thank you for the response! I've routed this to the appropriate Team to investigate and update.

[cherylmc]

@ashjain - can you please help with this question?

[hemantaltair]

Hi, any update on that?

[elliot-huffman]

Hi @dcuenot ,

You can only connect to bastion through the Azure portal. It was designed this way because exposing RDP and SSH ports to the internet is a HUGE security risk.
To execute local scripts, you will need to get them to the remote machines some how.
I would recommend git repositories or Azure DevOps. You can direct deploy to the machines.

Does this answer your question?

Thanks!

[cegganesh84]

Hi @elliot-labs,

I would like to set up a socks tunnel to bastion host from my laptop so that I could view the UIs in the VMs. Any tips for this use case?

Thanks!

[elliot-huffman]

Hi Cegganesh84,

The bastion host resource only offers HTML to RDP/SSH.
It does not expose the RDP/SSH to you directly.
It runs only from the web browser.
Because of this a socks tunel (ssh tunnel) is not possible to a bastion host from an admin machine.

Thanks!

[cherylmc]

please-close

[samartzidis]

If it only uses the Azure infrastructure to connect why does in need to expose port 443 on a public Internet IP? What protocol does it expose on 443 and what makes this more secure than SSH on 22?

[NeoTech]

@samartzidis It doesnt, but there is this idea in infosec/devops circle that a 2048 bit TLS certificate is alot more safe than 4096 AES+DES certificate over SSH - The fact that it would take 15x more time to brute force the later one is not takein into consideration, that both protocols can be middle man attacked is not taken into consideration either. Its a good scare tactic to make people pay for extra services tho.