Re: [PLUG] some bash help

["Gavin W. Burris" <bug@wharton.upenn.edu>]

Hrm.  Maybe a key restriction wouldn't use a command option.  Maybe it just needs the permitopen="host:port" option.

Also, maybe this:  https://github.com/apenwarr/sshuttle

Cheers.

On Wed 10/28/15 01:17PM EDT, Gavin W. Burris wrote:
> Hrm.  One could enforce key-only auth to the first box, then restrict the allowed commands in the admin users ~/.ssh/authorized_keys file on the first box.  Something like:
> 
> command="ssh carl@191.168.1.123:22" ssh-rsa AAAAXXXXX...............
> 
> The command string has to be exact though, which I think can be pulled from the logs after one attempt.
> 
> Cheers.
> 
> 
> On Wed 10/28/15 12:59PM EDT, Paul Jungwirth wrote:
> > On 10/28/2015 09:46 AM, Carl Johnson wrote:
> > >I have a server that I need to use as a transparent jump box to another
> > >network. What I'd like to do is have a "serveradmin" user be able to SSH
> > >into "serverA" and automatically be SSH'ed into another server,
> > >"serverB". If this second ssh session to serverB is killed (i.e. ctrl+c)
> > >or dies for whatever reason I'd like the original ssh session to serverA
> > >to collapse too.
> > 
> > I assume you want serverA to enforce this, so telling the local .ssh/config
> > to use a proxy isn't an option?
> > 
> > What if in serverA's /etc/passwd the login shell for serveradmin *is* the
> > ssh command to go to serverB (or some wrapper script). It seems that a ^C
> > should then kill the whole thing. I wouldn't be surprised if there were
> > still some way to run commands on serverA though.
> > 
> > Paul
> > ___________________________________________________________________________
> > Philadelphia Linux Users Group         --        http://www.phillylinux.org
> > Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
> > General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug
> 
> -- 
> Gavin W. Burris
> Senior Project Leader for Research Computing
> The Wharton School
> University of Pennsylvania
> ___________________________________________________________________________
> Philadelphia Linux Users Group         --        http://www.phillylinux.org
> Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
> General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

-- 
Gavin W. Burris
Senior Project Leader for Research Computing
The Wharton School
University of Pennsylvania
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug