Jump Servers must be able to reach to a certain private network and this requires specific configuration for each environment;
Yup. Use VPNs and firewall ACLs. Jump servers are leftovers of bad practices where good practices were too hard to implement.
Burden of managing SSH keys of users throughout all nodes. Rotation is required when someone leaves or enter the organization;
That is extremely trivial if you have (you should) any sensible configuration management in place. We just store them in LDAP with user data and distribute where neede (gitlab, servers)
Role management requires managing sudoers files, making sure file system permissions are properly configured and users are within their proper groups;
Ah yes, managing a text file, so fucking hard /s
Nodes must be updated with the tooling necessary to interact with internal services.
Keep a list of updated services (DNS) available to interact with it
see the point about CM
Usually, infrastructure enginners are a scarce team and keeping all these components updated are hard to tackle. Over time, these nodes will onboard more users and tooling, which will increase the complexity over managing these resources.
Which is why you write it once and use automation. I don't think we touched our sudoers or ssh key management module in years, it was written once then had some small changes but that's about it
Comments
Yup. Use VPNs and firewall ACLs. Jump servers are leftovers of bad practices where good practices were too hard to implement.
That is extremely trivial if you have (you should) any sensible configuration management in place. We just store them in LDAP with user data and distribute where neede (gitlab, servers)
Ah yes, managing a text file, so fucking hard /s
see the point about CM
Which is why you write it once and use automation. I don't think we touched our sudoers or ssh key management module in years, it was written once then had some small changes but that's about it