HashiCorp Boundary for Secure SSH Access in Australia

Pinning every admin login to a single jump host creates the kind of soft target that troubles Aussie sysadmins working under the Privacy Act 1988 and the Notifiable Data Breaches scheme. Once an attacker phishes a static key or compromises a shared account, lateral movement across hybrid environments in Sydney, Melbourne or Brisbane becomes trivial. Bastion hosts, by definition, sit on the perimeter and concentrate risk, which is the opposite of what modern security frameworks demand.

HashiCorp Boundary rethinks that model by brokering SSH sessions through an identity-aware proxy without exposing long-lived credentials. Rather than punching firewall rules for every new target, administrators define logical scopes and let the Boundary controller issue ephemeral credentials on demand. For teams juggling home-lab gear in suburban Adelaide, production racks in AWS ap-southeast-2, and remote desktops somewhere in regional WA, that abstraction delivers a single access plane that aligns with zero-trust principles encouraged by the Australian Signals Directorate.

Planning the Architecture Around Local Realities

Before installing binaries, sketch where the controller and workers will live and how Australian data-residency rules will shape that layout. The Boundary control plane can run self-hosted on Linux VMs in NEXTDC or Equinix facilities, or it can be consumed as a managed service through HashiCorp Cloud Platform with the control plane hosted overseas. For organisations caught by APRA CPS 234 or the Australian Privacy Principles, the self-hosted route keeps audit logs and session recordings inside Australian borders, which simplifies evidence collection during a notifiable data breach investigation.

Plan for at least two workers behind a load balancer so maintenance windows can be scheduled during AEST business hours without dropping active sessions. If the workers are deployed in different regions, a Sydney-based primary can serve east-coast admins while a Perth worker absorbs west-coast traffic, trimming session latency that becomes painful when admin consoles feel sluggish. PostgreSQL 13 or later is the supported backend, so include its patching cadence into your change-advisor schedule from day one.

Installing the Controller and Workers

The install itself is straightforward on common Australian enterprise Linux of choice, typically Rocky Linux or Ubuntu 22.04. Pull the official Boundary release, drop the binary into /usr/local/bin and create a dedicated systemd unit so the service survives reboots. The controller listens on port 9200 by default, while workers speak to it on 9201, so confirm those ports are reachable from jump hosts and admin laptops without exposing them publicly on the internet.

Generate a real TLS certificate rather than relying on the self-signed default. Let's Encrypt works for internet-facing controllers, but for internal-only deployments a private CA signed by your existing Active Directory certificate authority keeps certificate management familiar to staff. Store the controller's root KMS key in HashiCorp Vault or AWS KMS with the Sydney endpoint so the decryption material never leaves the country. Once the units are active, point the Boundary CLI at the controller address and run boundary server configure to verify connectivity across all worker nodes.

Mapping Bastion Hosts as Targets

With the cluster healthy, the next task is teaching Boundary about the existing jump boxes that currently sit in DMZ segments between corporate LANs and AWS workloads. Each legacy bastion becomes a Boundary host set, and the actual SSH port 22 endpoint becomes a target underneath. Resist the urge to wire every internal Linux VM directly to Boundary; keep the existing bastion in front for day-to-day work until the new model is proven in parallel.

Scopes let you mirror existing team boundaries. A Sydney operations group gets a scope that includes bastion hosts serving billing systems, while a separate development scope isolates engineering access. Host catalogs referencing public SSH keys are added through Boundary's plug-ins, which play nicely with VMware and AWS inventories that most Australian sysadmins already maintain. After the first session is brokered via boundary connect ssh, verify the session appears in the audit log before deleting traditional key-based entries from authorized_keys.

Authenticating With Vault and Local Identity Providers

Credential brokering is where Boundary pulls ahead of a plain jump host. Configure an auth method that points at your existing Okta, Microsoft Entra ID or Google Workspace tenant, then enforce multi-factor authentication so accounts that drift towards compromised status cannot easily pivot into production. Boundary can fetch ephemeral SSH credentials from Vault's SSH secrets engine, meaning the private key never reaches the admin's laptop in the first place.

Financial services entities that fall under APRA CPS 234 should treat this as a compliance win rather than a nice-to-have. The combination of strong authentication, short-lived credentials and session authorisation provides evidence packs during audits that demonstrate least-privilege access. For remote staff working from home on the NBN, the additional session hops are usually invisible because Boundary tunnels through existing HTTPS egress.

Capturing Recordings for Audit and Forensics

Session recording closes the loop. Attach a recording storage bucket in your preferred region — for most locals that means an S3 bucket in ap-southeast-2 — and turn on SSH session capture. Recordings are encrypted at rest and can be replayed through the Boundary UI when investigating suspicious activity, which is particularly useful after the wave of high-profile breaches affecting local businesses in recent years.

Store the audit and recovery procedure alongside the runbook. Australian organisations subject to the Notifiable Data Breaches scheme have 30 days to assess and 72 hours to notify after becoming aware of an eligible breach, so the ability to pull a session recording within minutes of a suspected incident is invaluable. Build a small cron job or Lambda in the Sydney region that rotates session logs into long-term archival storage, and align the retention window with the seven-year recordkeeping expected by some regulated industries.

Practical Recommendations Before Going Live

• Pilot Boundary with a read-only target first, then expand scope after the team is confident.
• Store the controller recovery key in Vault, with a paper copy sealed in the office safe.
• Use HCP Boundary only after the data-residency implications of an overseas control plane are reviewed.
• Enable MFA on the upstream identity provider before exposing any production scope.
• Schedule quarterly access reviews tied to your existing IAM governance cadence.
• Validate that outbound HTTPS from workers reaches the controller without being filtered by corporate proxies.