Wayk Bastion Documentation

Hi,

You are not the first to inquire about this, and I am wondering what would be the simplest way to document this. Explaining everything can result in a quite large article, so would it be worth it to make an article that focuses on simply making the inventory of all the types of protocols and ports used in a complete deployment, so you can make sure to allow it on your firewall. From this article I would link to other articles going into more details about the complete connection flow, which would be much longer.

Do you want an explanation of the complete *flow*, which includes the testing of multiple connection routes (direct connections, relay connections) using multiple protocols, after which the most optimal one is selected for the remote desktop connection? Or is this too much detail into the inner workings of the solution?

Here is the best part of the current documentation:
https://docs.devolutions.net/wayk/bastion/index.html#deployment
https://docs.devolutions.net/gateway/getting-started.html

I also attached to this post my slides from a presentation I did at Devolutions Central Online, it goes much more in depth. I'll see if I can reuse parts of it and include them in the docs.

Best regards,

Hi Marc,
I've read the full current documentation and seen the video from Devolutions Central Online. What I'm missing is the information about the security of it, in the video we're told Bastion handles the authorization, but not how it handles it. I'm sure that the documentation will help a lot with implementing the system, but firstly I'll have to clarify if it is responsible to do so. I hope you get what I mean.

"Do you want an explanation of the complete *flow*, which includes the testing of multiple connection routes (direct connections, relay connections) using multiple protocols, after which the most optimal one is selected for the remote desktop connection? Or is this too much detail into the inner workings of the solution?"

It would be nice with a flowchart of the possible ways to implement it.

Best Regards
Skj.

Hi,

I'm glad that I asked, because I would have gone in a totally different direction :) Peer-to-peer network connectivity is a topic of its own, and it's true that while we say that Wayk Bastion handles the authorization, we never got into the details of it.

Long story short, the entire peer-to-peer connection flow is checked for authorized by Wayk Bastion using a short-lived session token emitted by Wayk Bastion to the Wayk Client when the session is created. This token is used by the Wayk Client to prove to the Wayk Agent that Wayk Bastion knows about this peer-to-peer session, and has authorized its creation. Without a valid session token, the target Wayk Agent simply refuses to initiate the peer-to-peer connection.

The system authentication with Secure Remote Delegation (SRD) is entirely separate from this. The credentials are managed separately, and Wayk Bastion simply authorizes the ability to *connect* to the target system, but does not provide the client with the target system credentials.

Now the part which still lacks documentation is how Wayk Bastion authorizes a user to attempt connecting to a target system, and how you can restrict users to specific machines. We have an RBAC system inspired by the Azure RBAC system, where you create role assignments between:

1) A security principal (user, user group)
2) A role definition (a list of permissions)
3) A resource scope (subscription, tenant, unit, resource group, resource)

For instance, if you have a group of users called "technicians" that need access to a group of machines called "Lab Machines", you can create a role assignment between:

1) "technicians" user group
2) "Machine User Login" role definition
3) "Lab Machines" resource group scope

Should I understand that what you are looking for is mostly how the RBAC system works, and how you correctly configure and setup the RBAC rules for proper authorization by Wayk Bastion, where this would potentially be even more interesting than detailing the inner workings of the peer-to-peer connection process?

Best regards,

Hi Marc,

The main part would be a full explanation of how it works from beginning to end. I'm aware how the RBAC concept works. Examples - hope this explains my thoughts.

Agents:
How are they registered
How does the traffic flow
How do they establish the connection to Bastion upon startup

Clients:
How are they authenticated
How does the traffic flow
How do they establish the connection to Bastion upon startup

Bastion:
Where and how is the data secure
Informations about the Containers
Authentication?
Authorization?

Best Regards
Skj.