Safe Remote IT Support: Secure Architectures, Bastion Hosts, and Zero Trust

Remote administration and technical support are fundamental requirements for managing distributed modern enterprises, branch offices, and cloud infrastructure [1]. However, remote access pathways represent the single most heavily targeted entry point for ransomware gangs and nation-state threat actors [1, 2].

The practice of port-forwarding Remote Desktop Protocol (RDP port 3389) or Secure Shell (SSH port 22) directly across public internet firewalls is responsible for thousands of catastrophic network compromises annually [1, 2]. In this technical guide, we examine the mechanics of secure remote administration, evaluate hardened bastion jump hosts, review session recording and auditing requirements, and explore modern Zero Trust Network Access (ZTNA) architectures [1, 2, 3].

1. The Perils of Exposed Management Protocols

Exposing administrative ports directly to the public internet introduces critical vulnerabilities [1]:

• Automated Credential Brute-Forcing: The moment TCP port 3389 (RDP) or port 22 (SSH) is opened to the public internet, automated botnets begin submitting thousands of credential pairs per hour. Weak or compromised passwords lead to immediate domain takeover [1].
• Protocol Vulnerabilities & Zero-Days: Management daemons contain complex protocol stacks. Flaws in RDP (such as historical BlueKeep vulnerabilities) allow unauthenticated remote code execution directly at system kernel privileges [1].
• Lack of Granular Authorization: Once an attacker authenticates to an exposed RDP host on the corporate LAN, they gain full network layer access to traverse the entire subnet laterally [1, 2].

2. The Bastion Host (Jump Box) Architecture

To eliminate public exposure, organizations deploy an isolated, hardened intermediary gateway known as a Bastion Host or Jump Box [1, 3]:

[ Remote Administrator ]
           |
           | TLS 1.3 / SSH Encrypted Tunnel (Protected with Hardware MFA)
           v
[ Network Firewall: WAN Interface ]
           |
           v (Strict Ingress Policy: Allow only to Bastion IP)
+-------------------------------------------------------------+
|                     DMZ Subnet (Isolated)                   |
|                                                             |
|                   [ Hardened Bastion Host ]                 |
|                   - Hardware Key Authentication (FIDO2)     |
|                   - Session Recording & Keylogger Audit     |
|                   - Ephemeral Just-In-Time Credentials      |
+-------------------------------------------------------------+
           |
           v (Internal Firewall Policy: Allow only administrative protocols)
+-------------------------------------------------------------+
|               Internal Production Server Subnet             |
|                                                             |
|   [ Database Cluster ]    [ Active Directory ]    [ SAN ]   |
+-------------------------------------------------------------+

Bastion Hardening Standards

1. Enforce Public-Key Authentication Only (RFC 4253): Disable password-based authentication globally in sshd_config (PasswordAuthentication no). Require modern Ed25519 cryptographic keys backed by physical hardware tokens (e.g., FIDO2 YubiKeys) [2, 3].
2. Restrict Ingress via IP Allowlisting: When feasible, restrict firewall ingress access to the bastion host to static corporate office IPs or dedicated VPN ranges [1].
3. Session Recording and Command Auditing: Configure Linux auditd or commercial privileged access management (PAM) software to record full keystrokes and video sessions for administrative accountability [1].

3. Transitioning to Zero Trust Network Access (ZTNA)

While VPNs and bastion hosts protect perimeters, they operate on a legacy concept: once authenticated, the user is "inside" the trusted network [2].

Under NIST SP 800-207 Zero Trust Architecture, security models assume the network is already hostile:

• No Implicit Trust: Access is granted to specific, individual applications rather than broad network subnets [2].
• Identity-Aware Proxies: Users authenticate to a cloud access proxy using biometric MFA. The proxy dynamically verifies device health (antivirus active, disk encrypted, OS patched) before establishing an ephemeral, reverse-tunnel session to the target internal machine [1, 2].
• Zero Exposed Inbound Ports: Internal servers establish outbound connections to the cloud broker. The firewall maintains a 100% closed posture with zero open inbound ports on the WAN [2].

Remote IT Administration Architecture Comparison

Practical Enterprise Implementation Checklist

To protect remote IT administration channels:

1. Conduct an Immediate Perimeter Audit: Scan public WAN IP ranges to confirm that TCP ports 3389, 22, 23, and 5900 are completely blocked at the external firewall [1].
2. Enforce Phishing-Resistant MFA: Require hardware FIDO2 keys for all remote access logins; eliminate SMS and voice one-time passwords [2].
3. Deploy Just-In-Time (JIT) Access: Eliminate standing administrative rights. Technicians should request temporary administrative tokens that automatically expire after 2 to 4 hours [2].
4. Isolate Third-Party Vendor Access: External software vendors must access internal systems exclusively through supervised, session-recorded jump boxes with time-bounded access approvals [1, 2].

To design a Zero Trust remote administration framework or deploy managed privileged access gateways, visit our Cyber Security Solutions page.

Key Takeaways

• Exposing RDP or SSH ports directly to the public internet is a major vulnerability that invites automated brute-forcing.
• Hardened bastion jump hosts in isolated DMZ subnets terminate external connections safely with key-based authentication.
• Full session recording and keystroke logging provide non-repudiation and forensic accountability.
• Zero Trust Network Access (NIST SP 800-207) eliminates open inbound ports and grants access to specific applications rather than entire subnets.

Need help with this? Contact us.

Sources

[1] National Institute of Standards and Technology (NIST), "NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security", 2016. URL: https://csrc.nist.gov/pubs/sp/800/77/r1/final (Authoritative federal standard on remote access architecture, VPN security, and administrative endpoint isolation).

[2] National Institute of Standards and Technology (NIST), "NIST SP 800-207: Zero Trust Architecture", 2020. URL: https://csrc.nist.gov/pubs/sp/800/207/final (Federal standard establishing Zero Trust principles, continuous policy verification, and identity-aware access proxies).

[3] IETF, "RFC 4253: The Secure Shell (SSH) Transport Layer Protocol", 2006. URL: https://www.rfc-editor.org/rfc/rfc4253.html (Standards-track specification for encrypted administrative remote access, public-key verification, and cipher negotiation).

Last reviewed: October 2026