Bastion informatique : définition, rôle et choix en PME et ETI

Key Takeaways

• An IT bastion centralizes, secures, and tracks all privileged access to your IT system (administrators, external service providers, DevOps teams).
• Avec NIS2, la gestion des accès privilégiés fait partie des mesures attendues des PME classées entités essentielles ou importantes.
• 3 solutions de référence en 2026 : Azure Bastion (service Microsoft Azure, facturé à l'usage), Wallix (éditeur français, sur devis), CyberArk (grands comptes, sur devis).
• Budget : sur devis, selon le nombre d'utilisateurs privilégiés et le mode de déploiement. À combiner avec MFA et politique de moindre privilège pour un dispositif complet.

Un seul compte administrateur compromis peut suffire à paralyser un système d'information entier. C'est précisément le scénario que le bastion informatique est conçu à prévenir. En imposant un point de passage unique pour tous les accès privilégiés, administrateurs, prestataires, techniciens, il réduit la surface d'attaque et assure une traçabilité complète de chaque action.

Cet article explique comment fonctionne un bastion, comment le déployer, et pourquoi il répond aux exigences de la directive NIS2 et de la norme ISO 27001. Le bastion fait partie des dispositifs que nous mettons en place en tant que prestataire en sécurité informatique.

‍

1. What is an IT bastion?

Un bastion informatique, aussi appelé serveur de rebond, jump server ou solution PAM (Privileged Access Management), est un serveur durci par lequel passent obligatoirement tous les accès d'administration à votre système d'information. Il vérifie l'identité de chaque administrateur ou prestataire, n'ouvre que les accès autorisés et enregistre chaque session. Une solution de bastion sert donc à contrôler, tracer et protéger les comptes à privilèges.

In practice: No administrator is allowed to connect directly via SSH or RDP to a production server. All connections must go through the bastion host, which authenticates the user, verifies their permissions, logs the session, and forwards it in encrypted form to the target.

The bastion answers a simple question: "Who did what, when, and from where?" Without a bastion, this question often remains unanswered after an incident.

‍

2. Architecture of a bastion: complete diagram

The diagram below shows the architecture of an IT bastion: authorized traffic, blocked access, and connections to the SIEM.

‍

Schéma d'architecture d'un bastion informatique, IT Systèmes

‍

Reading the diagram

• All users (internal administrators, external service providers) must access the system through the bastion.
• The bastion server requires strong authentication (MFA) and records video sessions.
• Direct RDP or SSH access to internal servers is blocked at the firewall level.
• The bastion transfers encrypted data streams to the target resources (Windows, Linux, databases, Active Directory).
• All logs are sent in real time to the SIEM for detection and correlation.

‍

‍

‍

‍

3. Key features of a bastion

‍

3.1 Strong Authentication (MFA)

The bastion requires multi-factor authentication for all access. When combined with LDAP or Active Directory, it ensures that only authorized users can log in.

• TOTP (Google Authenticator, Microsoft Authenticator)
• X.509 certificates or SSH keys
• RADIUS Integration for Service Provider Access

3.2 Session Recording

‍

Each session is recorded as a video stream and text logs (keyboard keystrokes). In the event of an incident, it becomes possible to replay exactly what happened.

‍

Retour terrain IT Systèmes - ETI industrielle 200 postes

Contexte : audit préalable à la certification NIS2, 47 comptes admin découverts.

Findings: 12 former service providers still had active access. 8 accounts had the password "Admin2023!". 3 service accounts were set to Domain Admin without justification.

Deployment: WALLIX Bastion + MFA in two weeks. 19 accounts revoked immediately.

Result: Passed the NIS2 audit three months later with no findings. Zero incidents in 12 months.

‍

3.3 Privileged Account Management (PAM)

Most bastion hosts include a password vault feature. The passwords for service accounts are never visible to the user: the bastion host automatically enters the credentials during login.

• Automatic secret rotation (HashiCorp Vault compatible)
• Comptes de service non humains,, jamais exposés directement
• Ongoing inventory and audit of privileged accounts

4. Technical Specifications

‍

4.1 Règles iptables - bloquer les accès direct

# Autoriser uniquement les flux en provenance du bastion (règles spécifiques EN PREMIER)
iptables -A FORWARD -s <IP_BASTION> -p tcp --dport 3389 -j ACCEPT
iptables -A FORWARD -s <IP_BASTION> -p tcp --dport 22 -j ACCEPT

# Block all other direct RDP and SSH connections to internal servers
iptables -A FORWARD -p tcp --dport 3389 -j DROP # Direct RDP blocked
iptables -A FORWARD -p tcp --dport 22 -j DROP # Direct SSH blocked

# HTTPS only for the bastion's web interface
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

‍

4.2 Deploying Apache Guacamole (open source)

version: '3'
services:
 guacamole:
   image: guacamole/guacamole:1.5.5
   environment:
     GUACD_HOSTNAME: guacd
     MYSQL_HOSTNAME: mysql
     MYSQL_DATABASE: guacamole_db
     MYSQL_USER: guacamole_user
     MYSQL_PASSWORD: <CHANGE_ME>
   ports:
     - '8080:8080'
 guacd:
   image: guacamole/guacd:1.5.5
 mysql:
   image: mysql:8
   environment:
     MYSQL_ROOT_PASSWORD: <CHANGE_ME>
     MYSQL_DATABASE: guacamole_db

‍

‍

4.3 PowerShell - inventaire des comptes à privilèges

# List the members of the Domain Admins group
Get-ADGroupMember -Identity 'Domain Admins' | Select Name, SamAccountName

# Identify accounts with AdminCount=1 (potentially orphaned)
Get-ADUser -Filter {AdminCount -eq 1} -Properties AdminCount,LastLogonDate |
Select Name, SamAccountName, LastLogonDate, Enabled |
Sort LastLogonDate

‍

5. Compliance with NIS2, GDPR, and ISO 27001

‍

La directive NIS2 impose aux entités essentielles et importantes de mettre en place des mesures de gestion du risque cyber, dont la gestion des accès privilégiés fait explicitement partie.

‍

6. Ce que le bastion apporte au-delà de la sécurité

‍

Un incident de sécurité impliquant un compte admin compromis entraîne des coûts d'investigation, de remédiation, de perte d'exploitation, voire des amendes RGPD. Le coût d'un bastion, lui, dépend du nombre de comptes à privilèges et du mode de déploiement (voir le comparatif en section 11).

• Une attestation de contrôle des accès privilégiés à présenter dans les questionnaires d'assurance cyber
• Une détection plus rapide des accès anormaux lorsque le bastion est couplé à un SIEM
• Passing a NIS2 or ISO 27001 audit without any findings regarding "privileged access"

7. On-premises Bastion vs. Cloud

The choice between an on-premises solution and a cloud-based solution depends primarily on the IT architecture, latency tolerance, and regulatory requirements.

8. FAQ - Les 8 questions les plus fréquentes

‍

What is the difference between a bastion host and a VPN?

A VPN encrypts a network tunnel and provides broad network access. A bastion host provides granular, session-by-session application access with logging. The two are complementary: the VPN for network access, and the bastion host for access to critical resources.

Mon équipe est petite (< 10 personnes). Est-ce utile ?

Oui. Les PME sont exposées aux mêmes compromissions de comptes admin que les grandes entreprises. Un bastion open source comme Apache Guacamole peut être déployé en quelques heures et ne nécessite pas d'équipe dédiée.‍

How long will it take to roll it out?

A basic deployment (Bastion + MFA + AD connection) takes 1 to 3 days. Full integration with SIEM, a password vault, and team training takes 2 to 4 weeks.‍

What happens if the bastion breaks down?

A properly architected bastion is deployed in a high-availability (active/standby) configuration. As a last resort, a documented break-glass procedure allows for emergency access, with immediate notification to the CISO.

How should non-human service accounts be managed?

Service accounts must be integrated into the PAM system with automatic secret rotation. HashiCorp Vault or CyberArk enable dynamic credential injection without ever exposing them in plain text within scripts.

Does Bastion slow down connections?

La latence ajoutée reste faible sur un réseau LAN. Pour les accès distants, l'impact est négligeable car la session RDP/SSH est déjà latente. Un bastion cloud mal dimensionné peut en revanche générer des délais plus importants.

Which stronghold should I choose based on my profile?

• PME < 50 postes : Apache Guacamole (open source, gratuit)
• Companies with 50–500 employees: WALLIX Bastion, CyberArk Vendor PAM, BeyondTrust Remote Support
• Enterprise Accounts / Azure Cloud: Azure Bastion + Microsoft Entra PIM
• Telco/Industrial Environment: Claroty, Nozomi Networks withPAM module‍

‍Comment évaluer l'intérêt d'un bastion pour une PME ?

Comparez le coût du bastion, établi sur devis selon le nombre de comptes à privilèges, à ce que coûterait un incident sur un compte admin : investigation, remédiation, arrêt d'activité et éventuelles amendes. Un contrôle des accès privilégiés documenté aide aussi à répondre aux questionnaires d'assurance cyber.

‍

9. Why companies get hacked through admin accounts

Les comptes administrateurs sont la cible principale des attaquants pour une raison simple : ils donnent accès à tout. Selon le rapport Verizon DBIR 2023, 74 % des violations de données impliquent un facteur humain, et les identifiants volés restent le premier moyen d’intrusion utilisé par les attaquants externes.

In the case of ransomware, attackers aren't trying to crack complex encryption: they steal an admin password, gain access, and encrypt the data without being noticed.

‍

Anatomy of a Ransomware Attack via an Admin Account

Voici un déroulé type, fréquemment décrit par les équipes de réponse à incident :‍

• Targeted phishing or credential stuffing. The attacker obtains the password for an admin account, often through a data breach or a brute-force attack on an exposed RDP server.
• Direct RDP connection. Without a bastion host, nothing blocks or logs this connection. The attacker is on the server in seconds.‍
• Mouvement latéral. Avec un compte Domain Admin, il accède aux autres serveurs, aux sauvegardes, à l’Active Directory. L’attaquant peut rester plusieurs jours sans être repéré : tous incidents confondus, la durée médiane de présence avant détection était de 16 jours en 2022 (source : Mandiant M-Trends 2023).‍
• Encryption and ransom demand. The backups are deleted first. The encryption process takes a few hours. The discovery is made the next morning.

A bastion would have blocked stage 2: without direct RDP access, the attacker cannot proceed, even with a valid password.

‍

‍

10. The 5 Most Common Mistakes Without a Stronghold

These five scenarios consistently arise in audits conducted prior to the deployment of a bastion host. Each one represents a potential attack vector.

‍

Erreur 1 : Comptes admin partagés entre plusieurs personnes

‍

Three technicians are using the same “administrator” account with the same password. When an incident occurs, it is impossible to determine who did what. In the event of an investigation, the company cannot provide any admissible evidence. This practice is prohibited by ISO 27001 (A.9.2) and is incompatible with NIS2 requirements regarding access control.

‍

Erreur 2 : Accès RDP ouvert directement sur Internet

‍

Le port 3389 exposé sur Internet est scanné en permanence par des bots. Des moteurs comme Shodan recensent en continu les serveurs RDP accessibles publiquement. Un mot de passe faible ou réutilisé suffit pour entrer. La fermeture du port 3389 au niveau du pare-feu, avec accès uniquement via le bastion, élimine ce vecteur complètement.

‍

Erreur 3 : Comptes prestataires jamais révoqués

‍

Un prestataire intervient 6 mois, puis repart. Son compte reste actif. Sans inventaire centralisé des accès, personne ne le détecte. Dans l’audit cité en section 3.2, 12 comptes de prestataires partis étaient toujours actifs. Un bastion avec workflow d’approbation et durée d’accès bornée résout ce problème structurellement.

‍

Erreur 4 : Comptes de service avec des droits Domain Admin

‍

A service account created for a business application inherits Domain Admin privileges “just to make it work.” Its password hasn’t been changed in four years. If this application is compromised, the attacker gains access to the entire domain. The rule: the principle of least privilege, automatic rotation of credentials via PAM, and removal of excessive privileges.

‍

Erreur 5 : Absence de journalisation des sessions admin

‍

Without session recording, a post-incident analysis amounts to little more than guesswork. It is impossible to know which command was executed, which file was modified, or which configuration was altered. Cyber insurers and regulatory authorities (ANSSI, CNIL) are increasingly requiring this traceability as part of a security audit.

11. Comparison of bastion hosts: WALLIX, CyberArk, BeyondTrust, Guacamole

‍

The market for access management solutions covers a wide range: from open-source software that can be deployed in a matter of hours to full-scale PAM platforms for large enterprises. Here is a summary of each solution to help you choose based on the size and context of your IT system.

‍

WALLIX Bastion

Profile: Mid-sized companies and large enterprises, regulated sectors (finance, healthcare, manufacturing). French software publisher, ANSSI-certified.

Key features: French-language web interface , native NIS2/ISO 27001 compliance, session video recording, built-in password vault, on-premises or SaaS deployment.

Limitations: Expensive licensing for small organizations. Integration can sometimes be complex in highly heterogeneous IT environments.

Tarif indicatif : sur devis, selon le nombre d’utilisateurs et le mode de déploiement.

‍

CyberArk Privileged Access Manager

Profile: Large enterprises, multinational corporations, complex hybrid cloud environments. A leader in the global PAM market.

Key strengths: Very broad functional coverage (management of secrets, cloud access, endpoints), native integrations with AWS, Azure, and GCP, a strong community, and comprehensive documentation.

Limitations: Long deployment process (several months), high cost, requires a dedicated team for administration. Designed for IT systems with 500+ users.

Tarif indicatif : sur devis, selon le périmètre.

‍

BeyondTrust Remote Support

Profile: Mid-sized company with frequent interactions with service providers and remote support. Particularly well-suited for environments involving frequent interactions with external parties.

Key features: Detailed management of contractor sessions (time limits, real-time approval), video recording, and a complete audit trail. User-friendly interface for non-technical users.

Limitations: The password vault is less feature-rich than CyberArk or WALLIX. Less suitable for OT/industrial environments.

Tarif indicatif : sur devis, selon le nombre de techniciens et de cibles.

‍

Apache Guacamole (open source)

Target audience: Small and medium-sized businesses with fewer than 50 employees, non-profits, and local governments with limited budgets. Also used as an entry point into larger systems.

Key features: Free , deployable via Docker in a matter of hours (see section 4.2), supports RDP, SSH, and VNC, web access without the need to install a client.

Limitations: No built-in password vault, no out-of-the-box video recording, technical administration required. Does not, on its own, meet NIS2 requirements for critical entities.

Cost: Free (Apache 2.0 license). Actual cost = time spent on deployment and internal maintenance.

Le bon outil dépend du nombre de comptes à privilèges, du volume d’accès prestataires et de vos obligations NIS2. Notre offre de gestion des accès à privilèges (PAM) part de cet inventaire pour choisir la solution, puis la déployer.

12. Security checklist: What must be in place before granting admin access

This list covers the minimum controls required by NIS2 (Article 21) and ISO 27001 (A.9, A.12) for the management of privileged access. It can serve as a basis for an initial internal audit.

‍

Authentication and Access

• MFA enabled on all administrator accounts (TOTP, certificate, or SSH key)
• No admin accounts shared among multiple people
• RDP and SSH access is permitted only through the jump server (ports 3389 and 22 are blocked for direct incoming traffic)
• Vendor accounts created with a specified access period and automatically revoked upon expiration

Secret Management

• Automatic rotation of service account passwords (frequency: every 30 days at most)
• No plaintext passwords in scripts, configuration files, or emails
• List of privileged accounts updated quarterly (see PowerShell script in section 4.3)

Logging and Detection

• All recorded admin sessions (video streams + keystroke logs) are retained for at least 12 months
• Bastion logs sent in real time to the SIEM system, with alerts for connections outside of scheduled hours
• Documented emergency procedure with automatic notification to the CISO upon activation

Compliance and Governance

• Administrator rights review conducted every 6 months (User Access Review)
• Least privilege principle applied: no service accounts with Domain Admin rights without written justification
• Annual test of the high-availability failover procedure for the bastion server

13. How IT Systèmes supports you

IT Systèmes works with mid-sized companies and SMEs to deploy and integrate privileged access management solutions: initial audit, bastion configuration, and integration with existing SIEM systems.

• Assessment of the current state: mapping of privileged accounts, risk analysis
• Deployment and configuration: bastion host, MFA, PAM, password vault
• SIEM/SOC Integration: Event Correlation, Real-Time Alerts
• Training for IT Teams and the Chief Information Security Officer
• NIS2, GDPR, and ISO 27001 Compliance Monitoring

Bastion, rotation des mots de passe, enregistrement des sessions et MFA : notre offre de gestion des accès à privilèges (PAM) couvre ces quatre briques. Elle s’adresse aux PME et ETI qui doivent prouver ce contrôle lors d’un audit NIS2 ou ISO 27001.

→ Explore our cybersecurity offerings

‍