2

I have a windows local desktop and putty installed on it. Now I want to know - In AWS setup whether we can use Linux Bastion host to connect to Windows Ec2 instances in private subnet by using agent forwarding ?

Improve this question
1
  • 1
    SSH agent forwarding? Likely not. Port forwarding? Quite possibly. What happens if you try it?
    – user
    Commented Aug 4, 2017 at 9:31

2 Answers 2

Reset to default
5

As Michael K. said on the comment above, you are looking for Port forwarding, not agent forwarding.

Assuming your bastion hosts and the Windows EC2 instances are on the same AWS VPC and can reach each other, and also that you already can access the bastion host via SSH from your local desktop:

If you access the windows instance over RDP, on your local desktop, connect to the bastion with:

putty.exe -ssh -R 3399:<ip-of-ec2-windows-instance>:3389 <username>@<ip-of-bastion-host>

and after typing your password and getting the shell on the linux bastion host, the RDP server on port 3389 of your remote windows EC2 instance will be available at the desktop PC on port 3399. You can connect using a RDP client like Remote Desktop to 127.0.0.1 on 3399 port and the connection will be tunneled inside the encrypted SSH session.

You can repeat the -R <local-port>:<remote-ip>:<remote-port> part as many times as you need, so if you have several EC2 instances you can create a single SSH session mapping different local ports to each server RDP port.

Of course, as a bastion host, I would recommend at least:

  • Use public/private keys instead of passwords
  • Change SSH port to something different to 22
  • If your local desktop is under a know IP address, create a NACL on the AWS VPC allowing only that IP to reach the bastion.
  • Disable all unneeded services on that bastion host, and keep it constantly patched.

Hope that helps!

Improve this answer
2
  • As far as I understood, he can't access Windows EC2 directly because it located in private subnet. Probably he should use -L instead, something like the following putty.exe -ssh -N -L :9833:ec2-windows-private-ip:3389 ec2-user@bastion-public-ip. After that command EC2 Windows host will be available locally on port 9833
    – ALex_hha
    Commented Aug 7, 2017 at 9:24
  • You are right, I incorrectly used -R and what the OP need is -L. Also, I see I forgot to set the destination on the command line. Edited to fix both errors. Thanks!
    – Pablo
    Commented Aug 8, 2017 at 10:40
0

Does your Linux bastion host support at RDP client? If so you could use it to contact to the Windiows EC2 instances.

As long as you are connected to the bastion host and you have the correct Routing, NACLs and Security Groups configured in AWS you should be able to connect to the Windows EC2 instances.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .