Kapstone Hardened Bastion

Function

Apache Guacamole on the hardened base: browser-based SSH/RDP/VNC with MFA and session recording enabled by default, and SSO (OIDC/SAML) as a documented option.

• Provides administrators and vendors with browser-based access to SSH, RDP and VNC hosts. No client software is required and no RDP port is exposed to the internet.
• Requires MFA by default and records sessions by default, supporting accountability for who connected to which host and what was done.
• Supports single sign-on through OIDC or SAML as a documented option, so access terminates with the identity provider account.

Intended use

Organizations whose assessors ask how vendors and contractors reach production systems, and organizations seeking to eliminate internet-facing RDP.

A printable one-page summary is available for procurement and security staff.

Components

Gateway

Apache Guacamole (open source)

Protocols

SSH, RDP, VNC

MFA

Enabled by default

Session recording

Enabled by default

SSO

OIDC / SAML, documented option

Hardening

Baseline shared by every image

• AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
• FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
• SELinux in enforcing mode
• fapolicyd application allow-listing
• auditd configured with the STIG audit rule set
• Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
• Monthly rebuilds with current security updates

Each control is explained on the Compliance page.

Evidence

Documentation issued with every release

• Built on the hardened AlmaLinux 9 base; inherits its evidence pack
• MFA and session recording active from first boot
• Replaces exposed RDP and shared VPN credentials with a single audited access point

OpenSCAP scan results

Automated STIG scan output from the exact build deployed.

DISA-format .ckl checklist

Opens in DISA STIG Viewer and can be provided directly to an assessor or ISSO.

SBOM (CycloneDX)

A software bill of materials listing every package and version on the image.

Documented exceptions list

Each open STIG item, the reason it remains open, and the mitigating control. Suitable as POA&M input.

Acquisition

Marketplace listing, free trial and private offers

Free trial: one month on Azure, 30 days on AWS. The software fee is waived; the customer pays the cloud provider for the virtual machine. See Pricing.

Specifications