How to lock down direct access to production without losing your mind

Distributing SSH keys to engineers often turns into chaos. Someone quits, but their public key remains on dozens of production servers. Someone accidentally runs a dangerous command in the wrong terminal, and then you spend half a day in system logs figuring out whose session it was.

As the number of servers grows and the team expands, direct machine connections become a headache. Usually at this point, companies look at the 4A concept: authentication, authorization, accounting, and auditing. However, deploying heavy solutions like Teleport or CyberArk requires significant time and resources.

I recently came across a project called OneTerm on GitHub. It's a lightweight open-source access gateway written in Go and Vue.js. It solves the problem of centralized server access without complex configuration.

What's inside OneTerm

The principle is simple: OneTerm becomes a layer between employees and the production infrastructure. Developers don't connect to hosts directly via SSH or RDP. They log into OneTerm's web dashboard and launch the required session from there.

The project covers basic security needs:

• Single entry point with two-factor authentication support.
• Granting permissions for specific servers and user groups.
• Video and text log recording for each session. If something breaks on a server, the operation can be replayed in the built-in player to examine the details.
• Session isolation to prevent users from interfering with each other and from escalating privileges within the gateway.
• Protecting internal hosts from direct access from the external internet.

Besides standard SSH, OneTerm supports RDP and VNC protocols. This is useful for those who have Windows servers or virtual machines with graphical interfaces running in their infrastructure.

Technical stack and integrations

The project stack is quite familiar. The backend is written in Go, and the user interface is built with Vue.js using the Ant Design Vue library. The Go build provides low memory consumption and fast web terminal performance.

Developers added native integration with Veops CMDB. This is another of their open-source projects. If equipment accounting is maintained in their CMDB, servers are imported into the bastion with one click. No need to manually enter IP addresses, ports, and credentials.

Let's look at the system interface.

The terminal works right in the browser window. Engineers don't need to configure local clients, set up tunnels, or store keys on their laptops.

Access rights are segmented based on time and roles. You can grant access to a server only for the on-call period or during technical work.

How to deploy and test

For a local introduction, the authors prepared a Docker Compose configuration. Startup takes a couple of minutes:

git clone https://github.com/veops/oneterm.git
cd oneterm/deploy
docker compose up -d

After the containers start, the web interface opens at http://127.0.0.1:8666. The default login is admin, and the password is 123456.

For a production environment, this option won't work. For this case, the developers wrote an interactive setup script ./setup.sh. It generates random passwords for the database and internal services, updates the configs itself, and saves a backup.

git clone https://github.com/veops/oneterm.git
cd oneterm/deploy
./setup.sh
docker compose up -d

If you want to add your own functionality, the project has ready-made hot-reload scripts for the frontend and backend: ./dev-start.sh frontend and ./dev-start.sh backend. Node.js version 14.17.6+ and Go version 1.21.3+ are required for building.

Nuances and limitations

Before bringing the tool into a production environment, you should consider a few specifics:

• The code is distributed under the AGPL-3.0 license. If you decide to make a closed commercial SaaS solution from it, you'll need to open up your modifications.
• The main branch in the repository is constantly updated and may work unstably. For use on servers, only take built releases from the Releases page.
• The documentation is still fairly brief. Developers respond in GitHub Issues, but some details will need to be figured out directly from the source code.

Summary

OneTerm is suitable for small operations teams and system administrators who want to quickly organize access management. If you need a simple bastion host with session recording, access segmentation, and SSH and RDP support, the project will cover basic tasks without unnecessary complexity.

You can try the interface without installation on the official demo oneterm.v1ops.com with login demo and password 123456.