Bastion server: create users with the ability only to ssh destination server

Question

We have bastion server. We should have some users that need to SSH from local through bastion to C, using proxyCammand and private key.

I want to create users and group that should have access ONLY to ssh from the Bastion host (it happens via proxyCommand). They also don't need to read files.

How can I do that? Is there a way?

The other alternative, if the above is not possible, is to have only read access for allowed files, except restricted files (defaulted by OS) that have read access only to there groups.

Answer 1

This is how to allow a given user only to use some specified commands:

1. Change the user shell to restricted bash:

   chsh -s /bin/rbash <username>
   

2. Create a bin directory under the user's home directory:

   sudo mkdir /home/<username>/bin
   sudo chmod 755 /home/<username>/bin
   

3. Change the user's default PATH to this bin directory:

   echo "PATH=$HOME/bin" >> /home/<username>/.bashrc
   echo "export PATH >> /home/<username>/.bashrc
   

4. Create symlinks for the command(s) that the user requires:

   sudo ln -s /bin/<command> /home/<username>/bin/
   

5. Restrict the user from changing ~/.bashrc by making it immutable:

   chattr +i /home/<username>/.bashrc
   

This way you only create symlinks to the commands that you want to allow.

For doing the same for more than one user, you may create a bash script containing these commands and having the user's name as parameter.

EDIT: In CentOS, rbash may not be implemented directly and may need a symbolic link to be created, and similarly in some other versions of GNU/Linux such as Red Hat:

# cd /bin
# ln -s bash rbash

source

Edit2:

If rbash is too restrictive, then the normal bash might do as well, but this is more work: You will need to disallow executing almost all commands in /bin by using setfacl -m u:user1:r /bin/su for su and other commands that you don't want used, so they become read-only to the user and especially are not executable.

See this answer for more details.

Answer 2

Network traffic

You can use iptables to limit network traffic:

# Allow port 22 traffic to a specific IP/hostname for a specific user
iptables -A OUTPUT -p tcp --dport 22 -d allowed_host -m owner --uid-owner username -j ACCEPT 
# Block all other outgoing port 22 (SSH) traffic
iptables -A OUTPUT -p tcp --dport 22 -d 0.0.0.0/0 -j REJECT

File system access

To restrict filesystem access you can use File system permissions

They also don't need to read files.

to be able to log in they need to be able to read some files:

• The users home directory
• The executable and all libraries of the users shell

To disallow read access for a normal user you can remove the world-readable flag from a file owned by root, or remove the world-executable and world-readable flag from a directory owned by root:

# chmod o-r secret-file
# ls -l secret-file
-rw-r-----  1 root  root  0 Mar 27 13:23 secret-file

# chmod o-rx secret-dir/
# ls -ld secret-dir/
drwxr-x---  2 root  root  64 Mar 27 13:24 secret-dir/