1. Project Overview

OneTerm

OneTerm Bastion Host is designed and developed based on the 4A security concept: Authentication (Authen), Authorization (Authorize), Account (Account), and Audit (Audit).

Main Purpose: Primarily designed for enterprises to improve internal IT controls and compliance security by controlling and auditing IT personnel's operational activities.

Main Features: Role management, authorization approval, resource access control, session auditing, and more.

2. Open Source License

Licensed under AGPL-3.0

3. Screenshots

4. Feature Overview

Design philosophy

Problems Solved by OneTerm

OneTerm provides network security solutions designed to improve network security, especially when accessing sensitive systems and resources.

1. Access Control: OneTerm acts as an intermediary gateway, restricting direct access to critical systems. Users must first authenticate through OneTerm before accessing other servers or systems.

2. Security Auditing: OneTerm can record user logins and activities, providing audit logs for investigations in the event of security incidents. This helps ensure that every user's actions are traceable and auditable.

3. Bastion Host Access: OneTerm provides a gateway through which users can connect to other internal servers. This approach helps reduce the risk of directly exposing internal servers, as only OneTerm needs to be accessible externally.

4. Password Management: OneTerm can enforce stronger password policies and centrally manage passwords through a single entry point. This helps improve password security across the entire system.

5. Session Recording: OneTerm can record user sessions with servers, which is particularly useful for monitoring and investigating privileged user activities. In the event of a security incident, recorded sessions can be replayed to review detailed operations.

6. Protection Against Direct Attacks: Since OneTerm serves as the sole entry point to systems and resources, it can act as a primary barrier against attackers. This helps reduce the risk of direct attacks on internal systems.

7. Unified Access: OneTerm provides a single entry point through which users can access different systems without having to remember multiple login credentials. This improves user convenience and work efficiency.

OneTerm Advantages

As part of WeiYi Technology's IT operations system, OneTerm not only meets security control requirements, IT operations security auditing requirements, and the technical requirements of Level 3 Classified Protection, but also integrates closely with CMDB, making it convenient for users to operate.

1. Authentication and Authorization:  Oneterm should provide a powerful and flexible authentication and authorization mechanism. This includes support for multi-factor authentication to ensure that only authorized users can access internal network resources, as well as fine-grained user permission management.

2. Secure Communication:  Oneterm supports secure communication protocols and encryption technologies to protect data transmission between users and internal servers. This helps prevent man-in-the-middle attacks and data leaks.

3. Auditing and Monitoring:  Oneterm provides powerful auditing and monitoring capabilities, recording user activities and generating audit logs. This helps track security incidents, identify potential threats, and meet compliance requirements.

4. Remote Management and Session Isolation:  Oneterm supports remote management, enabling administrators to securely manage internal servers. It should also provide session isolation to ensure that users' access sessions are isolated from one another, preventing lateral movement attacks.

5. Seamless Integration with Open-Source CMDB  Oneterm is closely integrated with WeiYi CMDB (already open-sourced). Users can import assets from CMDB with a single click, ensuring convenient operations and streamlined workflows.

5. Tech Stack

Installation

docker-compose

Visit Yifei Open Source: https://code.exmay.com/ Download
cd oneterm
docker-compose up -d

Verification

• Open the following URL in your browser: [http://127.0.0.1:8000](http://127.0.0.1:8000)

• username: admin

• password: 123456