How to restrict a jump user (into openSSH jumpbox) to only SSH to another server?

Question

My Goal: restrict a jump users (into OpenSSH jumpbox) to only SSH to another server. Users should not be able to list directories, cd or anything else except ssh from jumpbox to another server.

What I have:

• Active directory users login into jump server then SSH to other servers
• OpenSSH jump server configured on Ubuntu 20.04

What I've done: edited the /etc/ssh/sshd_config:

Match User testuser
  AllowTcpForwarding yes
  X11Forwarding no
  AllowAgentForwarding no
  ForceCommand /bin/false

When I add ForceCommand /bin/false, testuser cannot even ssh to jump server. Without it, user can login to jump server but can still list directories and cd.

Answer 1

1. At first, let them use the restricted Bash rbash. See man bash "RESTRICTED SHELL" for information about this.

2. Now set the PATH for these users, here as an example username, to a unusual directory:

echo "PATH=/usr/restricted/bin" > /home/username/.bash_profile

3. And now add the commands as symbolic links or scripts to /usr/restricted/bin:

ln -s /usr/bin/ssh /usr/restricted/bin/ssh (for ssh to every host)

You can restrict the destination hosts with a script named /usr/restricted/bin/ssh which checks the first parameter, if this is one of the allowed hostname(s).