Skip to content

Instantly share code, notes, and snippets.

@lucagervasi

lucagervasi/README.md

Forked from smoser/README.md
Created November 2, 2021 15:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save lucagervasi/321322e13d2f5cdfa8dbed78701b74b5 to your computer and use it in GitHub Desktop.
Save lucagervasi/321322e13d2f5cdfa8dbed78701b74b5 to your computer and use it in GitHub Desktop.
Download ZIP
set up a ssh tunnel only user for ssh proxy jump
Raw
README.md

Set up a ssh tunnel only user

In order to give someone access to hosts that are available only by ssh "bouncing" (ProxyJump), add a user for this specific purpose.

We have an internal openstack where instances get IPs on per-tenant networks. Each tenant has a 'bastion' host that has a "public" ip (floating ip). You can access other instances by bouncing through the bastion. From time to time I want to let someone else into an instance. This could be done either with:

a.) just give them shell access to the bastion and let them hop through. Sharing an unrestricted shell account on my bastion is less than ideal. b.) assign a floating/"public" IP to the instance so they could go directly in. Floating IPs are limited, so this is less than ideal.

So instead, I have set up a single user as described here that can only be used for ProxyJump. It allows others proxied access to my instances but without granting them full shell access.

Heres how you can set this up.

  • Pick a name

     JUMP_USER="sshjump"

  • configure sshd

    We match by Match User here, but could also use Match Group. Add the following to your /etc/ssh/sshd_config, and make sure to adjust sshjump to your JUMP_USER

     Match User sshjump
   AllowAgentForwarding no
   AllowTcpForwarding yes
   X11Forwarding no
   PermitTunnel no
   GatewayPorts no
   ForceCommand echo 'This account can only be used for ProxyJump (ssh -J)'

    Then, restart sshd:

     sudo systemctl restart ssh

  • Add the user

    The shell can actually be /bin/true, but then you will not get the ForceCommand directive to do anything, which can be useful for a user connecting.

      sudo useradd "$JUMP_USER" "--home-dir=/home/$JUMP_USER" --create-home --shell=/bin/rbash
  # if you want to, set a password.
  sudo passwd "$JUMP_USER"

  • Add some ssh keys

      sudo -Hu "$JUMP_USER" ssh-import-id smoser

  • Try it out

    assuming you want to give access to ubuntu@10.5.0.188 and your host is jumphost

      ssh -J sshjump@jumphost ubuntu@10.5.0.188

References

The following urls had information to help put this together:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment