My Goal: restrict a jump users (into OpenSSH jumpbox) to only SSH to another server. Users should not be able to list directories, cd or anything else except ssh from jumpbox to another server.

What I have:

  • Active directory users login into jump server then SSH to other servers
  • OpenSSH jump server configured on Ubuntu 20.04

What I've done: edited the /etc/ssh/sshd_config:

Match User testuser
  AllowTcpForwarding yes
  X11Forwarding no
  AllowAgentForwarding no
  ForceCommand /bin/false

When I add ForceCommand /bin/false, testuser cannot even ssh to jump server. Without it, user can login to jump server but can still list directories and cd.

1 Answer 1

  1. At first, let them use the restricted Bash rbash. See man bash "RESTRICTED SHELL" for information about this.

  2. Now set the PATH for these users, here as an example username, to a unusual directory:

echo "PATH=/usr/restricted/bin" > /home/username/.bash_profile

  1. And now add the commands as symbolic links or scripts to /usr/restricted/bin:

ln -s /usr/bin/ssh /usr/restricted/bin/ssh (for ssh to every host)

You can restrict the destination hosts with a script named /usr/restricted/bin/ssh which checks the first parameter, if this is one of the allowed hostname(s).

  • Hi Erich. Thanks for your reply. I'm unable to use the rbash for the users as they are not local to the openssh jumpbox. In fact the users come from active directory and they won't appear under /etc/passwd on openssh. However, i can see user groups (coming from AD) with the command "groups". Sorry again, i'm not a linux expert. Kindly elaborate in details your approach. Thanks Feb 21 at 21:20
  • You can distinguish between local and AD users with the command getent --service=files passwd username. With this information you set in the script /etc/profile for the AD users the environment variable SHELL and execute it: setenv SHELL /usr/bin/rbash; exec $SHELL. Then you continue as described. Try it on a test machine first, with errors in /etc/profile you can lock yourself out.
    – Erich
    Feb 22 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.