You can do this somewhat transparently by forcing the user to use a ProxyCommand
locally, treating your own server as an SSH bastion host.
On your server (the bastion), restrict the user to nc
as follows in sshd_config
:
Match User restricted_usr
ForceCommand nc -w 600 restricted_usr_vm 22
On the client (assuming OpenSSH
) in ~/.ssh/config
:
Host myserver
ProxyCommand ssh bastion nc -w 600 restricted_usr_vm 22
(Windows users can use ssh proxies via PuTTY by using PuTTY's plink
).
Though, thanks to your ForceCommand
, I'm pretty sure the ssh command is ignored; ProxyCommand ssh bastion I am a bannana
should have the same effect. A direct connection (lacking ProxyCommand
) from the user will result in a raw SSH dump to restricted_usr_vm.
As noted in a comment to another answer here, ForceCommand
will make it very hard to manage SSH key access to the bastion host. I can think of two easy solutions: (1) Install a passwordless SSH key for that user on the bastion that grants access to the target host and have that user's crontab on bastion run scp restricted_usr_vm:.ssh/authorized_keys ~/.ssh/
or (2) Create a web form (like GitHub's) to allow uploading that file. (3) NFS can also work, but I'm not so fond of it because the .ssh
directory could become compromised by somebody with root (or the same UID) on any system that mounts it.
I posted a very similar answer (with more detail on ProxyCommand) to the very similar ServerFault question Username based SSH proxy.
I like this a lot better than ForceCommand ssh -t restricted_usr_vm
because it deals with timeouts better and ssh -t
is kind of clunky (and, perhaps by now in the past, sometimes unreliable). I'm also guessing that things like scp
won't work through this method while they'll work perfectly via ProxyCommand
.
.bashrc
, Bruce Schneier's inner child takes another long, sad draught of tequilla.