You can do this somewhat transparently by forcing the user to use a
ProxyCommand locally, treating your own server as an SSH bastion host.
On your server (the bastion), restrict the user to
nc as follows in
Match User restricted_usr
ForceCommand nc -w 600 restricted_usr_vm 22
On the client (assuming
ProxyCommand ssh bastion nc -w 600 restricted_usr_vm 22
(Windows users can use ssh proxies via PuTTY by using PuTTY's
Though, thanks to your
ForceCommand, I'm pretty sure the ssh command is ignored;
ProxyCommand ssh bastion I am a bannana should have the same effect. A direct connection (lacking
ProxyCommand) from the user will result in a raw SSH dump to restricted_usr_vm.
As noted in a comment to another answer here,
ForceCommand will make it very hard to manage SSH key access to the bastion host. I can think of two easy solutions: (1) Install a passwordless SSH key for that user on the bastion that grants access to the target host and have that user's crontab on bastion run
scp restricted_usr_vm:.ssh/authorized_keys ~/.ssh/ or (2) Create a web form (like GitHub's) to allow uploading that file. (3) NFS can also work, but I'm not so fond of it because the
.ssh directory could become compromised by somebody with root (or the same UID) on any system that mounts it.
I posted a very similar answer (with more detail on ProxyCommand) to the very similar ServerFault question Username based SSH proxy.
I like this a lot better than
ForceCommand ssh -t restricted_usr_vm because it deals with timeouts better and
ssh -t is kind of clunky (and, perhaps by now in the past, sometimes unreliable). I'm also guessing that things like
scp won't work through this method while they'll work perfectly via