20: Warpgate - Secure SSH Gateway

Warpgate is a secure SSH gateway (also called a "bastion host") that provides a web interface for managing SSH access to your server. Instead of connecting directly to your server, you connect through Warpgate, which adds an extra layer of security and makes it easier to manage who can access what.

For advanced features, API documentation, and technical details, see the official Warpgate documentation.

Why Warpgate?

Prerequisites

Note: Warpgate works great with Traefik and a domain name. Having a friendly URL like warpgate.yourdomain.com makes it easy to access the web management interface.

Step 1: Start Infinity Tools

sudo infinity-tools

Step 2: Install Warpgate

  1. Go to 📱 APPLICATIONS
  2. Select Warpgate
  3. Choose Install Warpgate

Using the Infinity Tools GUI

Step 2.1: Choose SSL Mode

You'll see two options. Here's what each means:

Simple rule of thumb: Use Traefik if you have a domain (recommended). Use Standalone if you don't have a domain.

Step 2.2: Domain Configuration (Traefik Mode)

If you chose Traefik, you'll be asked for your domain:

Step 2.3: Port Configuration (Standalone Mode)

If you chose Standalone, you'll be asked for a port:

What Happens During Installation

Step 3: Set Up Admin Account

After installation, Warpgate will run an interactive setup. You'll be prompted to create an admin account:

Admin Setup Prompts

  1. Admin username: Choose a username for the admin account (e.g., admin)
  2. Admin password: Choose a strong password (you'll use this to log into the web interface)
  3. Confirm password: Enter the password again to confirm

⚠️ IMPORTANT: Save these credentials immediately! You'll need them to access the web interface.

Step 4: Access Warpgate Web Interface

If Using Traefik

  1. Wait 30-60 seconds for SSL certificate generation
  2. Open https://warpgate.yourdomain.com in your browser
  3. You'll see the Warpgate login page

If Using Standalone

  1. Open https://SERVER_IP:8888 in your browser
  2. You'll see a security warning (normal for self-signed certificates)
  3. Click "Advanced" → "Proceed to site" to continue
  4. You'll see the Warpgate login page

Step 5: Login to Web Interface

  1. Enter the admin username you created during setup
  2. Enter the admin password you created during setup
  3. Click "Login"
  4. You'll see the Warpgate dashboard!

Step 6: Understanding Warpgate

Warpgate acts as a gateway (or "bastion") between you and your server:

How It Works

What You Can Do

Step 7: Add Your First Target (Server)

Before users can connect, you need to add a "target" (the server they'll connect to):

Adding a Target

  1. In the web interface, go to "Targets" or "Servers"
  2. Click "Add Target" or the "+" button
  3. Enter target details:
    • Name: A friendly name (e.g., "My Server")
    • Host: The server's IP address or hostname (usually localhost or 127.0.0.1 for the same server)
    • Port: SSH port (usually 22)
    • Username: The SSH username (e.g., your server username)
  4. Click "Save" or "Create"

For Same-Server Access

If Warpgate is running on the same server you want to access:

Step 8: Add Users

Now add users who can connect through Warpgate:

Adding a User

  1. In the web interface, go to "Users"
  2. Click "Add User" or the "+" button
  3. Enter user details:
    • Username: A username for Warpgate (e.g., "john")
    • Password: A password for this user
    • Email: Optional email address
  4. Click "Save" or "Create"

Granting Access

After creating a user, grant them access to targets:

  1. Go to the user's profile
  2. Find "Access" or "Targets" section
  3. Select which targets this user can access
  4. Save the changes

Step 9: Connect via SSH Through Warpgate

Now you can connect to your server through Warpgate:

SSH Connection

ssh -p 2222 warpgate-user@warpgate.yourdomain.com

Or if using standalone mode:

ssh -p 2222 warpgate-user@SERVER_IP

What Happens

  1. You connect to Warpgate on port 2222
  2. Warpgate asks for your Warpgate username and password
  3. After authentication, Warpgate shows you available targets
  4. You select which target (server) you want to connect to
  5. Warpgate connects you to that server

First-Time Connection

On your first connection, you'll see:

  1. Warpgate login prompt
  2. Enter your Warpgate username and password
  3. List of available targets
  4. Select a target to connect
  5. You're now connected to your server!

Step 10: Security Best Practices

Close Direct SSH Access

Once Warpgate is working, you can close direct SSH access to your server:

# Close port 22 (direct SSH)
sudo ufw delete allow 22/tcp

# Keep port 2222 open (Warpgate SSH)
sudo ufw allow 2222/tcp

⚠️ WARNING: Only do this after testing Warpgate! Make sure you can connect through Warpgate before closing port 22.

Firewall Configuration

User Management

Troubleshooting

Can't Access Web Interface

Can't Connect via SSH

Forgot Admin Password

Target Connection Fails

Where to Find Warpgate After Install

Managing Warpgate

Adding More Users

Simply repeat Step 8 for each user you want to add. Each user can have access to different targets.

Adding More Targets

Add more servers by repeating Step 7. Users can then be granted access to these new targets.

Viewing Sessions

The web interface shows active SSH sessions, including who's connected and what they're doing.

Session Recording

Warpgate can record SSH sessions for security auditing. Check the settings in the web interface to enable this.

You're Ready!

Warpgate is now installed and ready to use! Remember:

Next steps: Add your first target, create users, grant access, test SSH connection through Warpgate, and optionally close direct SSH access (port 22) for better security!

Revision #1
Created 17 November 2025 17:31:13 by bjoern
Updated 17 November 2025 17:31:30 by bjoern