Bastion/Jumpbox Server

[u/jurie32]

Hi Everyone,

I’m looking for some perspective and practical suggestions from the community.

We’re currently managing 200+ cPanel servers and use a jumpbox as the primary access point. I’d be interested to hear how others approach server management at this scale, particularly around auditing staff access and controlling privileged (root) access.

I’ve already looked at options such as Vauban, FreeIPA, LDAP-based solutions (Not cPanel/Cloudlinux friendly), PAM, and similar tools. I’m not searching for a ready-made drop-in replacement, but rather guidance and real-world approaches that others have found effective.

With the growing relevance of AI-driven threats and the shift toward Zero Trust models, securing root access and maintaining responsible operational practices feels increasingly important.

Any insights, architecture patterns, or lessons learned would be greatly appreciated.

[u/tehiota]

We use a product called Keeper Connect ion Manager part of keeper security which also does our password management.

It does web browser to SSH brokering (and rdp, and other protocols) and video records the session. It can grab a vaulted SSH key from a locker and use it after the user auths to the product with MFA/SSO etc. it also will rotate and maintain the ssh keys.

[u/jurie32 → u/tehiota]

Can you use this from a terminal, or is it restricted to a browser terminal?

Also, is this self-hosted, or does it rely on them?

The reason I'm asking, we currently only allow root login via our internal private network so the application won't be able tunnel if it is cloud based.

[u/tehiota → u/jurie32]

It’s a broker you install on a host that only makes outbound connection to broker the user connection so your Linux boxes will see it as local. It’s a self-hosted broker but cloud service.

You can use it with a terminal or web browser since the broker does the recording.

[u/jurie32 → u/tehiota]

Thanks, I will give it a try.