Skip to main content

Gateways (jump servers)

Gateways​

A gateway is AuthNull's SSH jump server. It runs on a jump box in your network, and every privileged SSH session to a Linux endpoint goes through it. Older versions of the console called it a "Jump Server" or an "SSH Proxy"; the console now calls it a Gateway everywhere.

To find gateways in the admin console, open Switch product → PAM and select Gateways in the sidebar.

How a session works​

A session through a gateway is two separate SSH connections:

  1. Operator → gateway. The operator connects to the gateway with a short-lived SSH certificate issued by AuthNull. Plain SSH keys are refused.
  2. Gateway → endpoint. The gateway reaches the endpoint with a key issued for that one session, released only after approval and only for a host and account that a policy names.

Before a session opens, three things must be true:

  • the operator holds a current AuthNull certificate,
  • a policy names that person, the endpoint and the account, and
  • the endpoint is onboarded and assigned to the gateway.

When all three hold, the gateway sends a push notification to the operator's device through your organisation's MFA provider (Settings → MFA Provider: AuthNull Authenticator, Duo Security or Okta Verify). The session opens only after the push is approved, and it is recorded.

If any one is missing, the connection is refused with the same generic message. Refusals are deliberately indistinguishable, so check all three when a connection fails.

The Gateways page​

The list shows each gateway with these columns:

Gateway -> The gateway name. Click it to open the gateway's overview. Status -> Online, Offline, In progress or Disabled Public IP -> The address operators connect to Listening on -> The address and port the gateway listens on (default port 2222)

Status is worked out from two facts:

  • In progress: the gateway is registered but has not checked in yet.
  • Online / Offline: the gateway has checked in at least once. It sends a heartbeat every 60 seconds and shows as Offline after three missed heartbeats.
  • Disabled: an administrator disabled it. Sessions through it are refused.

You can search by name and filter by status. Each row's ⋯ menu has Open, Enrol machines, Disable (or Enable) and Delete. Enrol machines, Disable and Enable are shown to administrators only.

Next steps​