0

I have a RHEL 7 server that we are using as a jumpbox to authenticate to all servers. Typically users will login to jumpserver(rhel 7) from local machine and then login to their respective virtual machines but lately users are storing data on their directory in jumpserver which is very small vm and we don't what users to store any data in-fact i want restrict users to just use it as jumpserver by disabling all others permissions to run any command.

flow: localmachine(open-ldap auth) --> jumpserver-rhel 7(ssh-only) ---> virtual machine

can someone shed some light on how to restrict domain/ldap and linux users to only ssh and do nothing apart from jump to their virtual machine.

Env: everything is rhel 7 based.

2
  • 2
    set up disk quota. Aug 5 '20 at 22:09
  • You could also set up their shell to something that doesn’t allowe interactive logins, and force them to use ssh port forwarding.
    – jsbillings
    Aug 5 '20 at 22:13
0

Depending on how clever your users are you may have to disable SFTP.

For the SSH part: You can

  1. set everyone's shell to rbash
  2. create e.g. /usr/local/bin/restricted
  3. create a symlink to ssh (and maybe other allowed commands) in /usr/local/bin/restricted
  4. set $PATH to /usr/local/bin/restricted only in /etc/profile / /etc/bash.bashrc
  5. delete ~/.bash_profile, ~/.bash_login, and ~/.profile in all home directories (and /etc/skel)
2
  • how would that disable to copy files via scp? Aug 5 '20 at 23:40
  • @planetmaker Depends on how scp is called on the remote side. If there is no separate method for calling scp then it could not be called and thus would fail. I have to give that a try. Aug 5 '20 at 23:54
0

You could configure ForceCommand in sshd_config with a script which checks whether SSH_ORIGINAL_COMMAND starts with ssh and runs that command line only in that case.

So the users would have to use

ssh jumphost ssh realtarget

instead of

ssh jumphost

and running ssh realtarget in an interactive shell there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.