Bad practice having a single SSH gateway with access to all environments?

Question

I have started at a new company and am in the process of locking down SSH access to be through a single SSH gateway server.

My question is, should I create a separate SSH gateway server for each environment? (QA, Dev, Stage, Prod)

We are fully in AWS so my current plan is to create an SSH Gateway server on a DevOps VPC and create peer connections to the QA/Dev/Stage/Prod VPCs.

Then I would manage access to environments via SSH keys.

My concern is that this single SSH gateway server has access to all environments, which is a little terrifying. But that being said, it is easier to manage and monitor access.

Answer 1

I assume your users connect to the gateway with ssh (possibly with additional credentials like a hardware-generated one-time-password), and then jump to the actual servers with a second ssh connection.

In itself, this is fine (and the usual thing that's done regularly by companies I've worked with). The secondary ssh connection (still) takes care of only letting those people in who are authorized. The job of the gateway is primarily to avoid the need for the ssh port of the servers to be open to the internet on the network level.

Obviously, you want to avoid people opening ssh tunnels, using proper settings in your global ssh/sshd configuration, and you will want to tighten down the gateway itself (for example, by having read-only home directories for your incoming users; and having no tools installed that can help in somehow bypassing any of your rules - i.e., no telnet, netcat and so on; ideally a chroot environment in which nothing except the ssh executable is available).