0

I am trying to configure a server that users will log into. Users will use this server as a box to jump into other servers via ssh. From jump server to others will use SSH key based authentication. The users are not allowed to login directly to the other servers. Hence, they need to go from the jump server to the others. The user accounts are locked "usermod -L username" on all other servers.

I have ran into a problem where these users also need to be able to use "sudo" on the other servers. The current problem is that when users are on one of the other servers and try to use sudo they get an error when entering the password "sorry, try again", even though the password is correct. This makes sense because I have locked the user account, preventing direct SSH login. The users are in the sudoers file.

Does anyone know how I could setup the other servers so they would allow the users to SSH only via key based from the jump server and allow the users to use sudo on the other servers(non-jump).

Any help would be greatly appreciated and thanks for your time.

0

You could either implement SSH Agent Forwarding. Or if you are using a jumphost for SSH Access, then, its best for you to use iptables or ufw on the other servers to ONLY allow SSH access to the specific IP (which is the jumphost ip address).

IPTABLES SETUP:

iptables -I INPUT -p tcp -s YourIP --dport 22 -j ACCEPT

Installation of UFW:

sudo apt-get install ufw
sudo ufw enable
sudo ufw allow from 15.15.15.51 to any port 22 ---- Change 15.15.15.51 to the jumphost IP Address

Also, on the other servers, edit the sshd config and prohibit root login to better implement security. Some server shells doesn't automatically ask for password. So you might as well install "ask-pass" so users can use their password.

One last thing, to easily manage users on this setup, make sure to create a group and include it on the sudoers (without password) then restart SSH. This grouping should be implement on those "other servers" and not on the jumphost server

0

This issue was resolved by adding the following match config to the sshd_config file. This config was placed on all the servers where direct access was not allowed.

Match User user1,user2,user3
PasswordAuthentication no

Now the users can access via key based authentication from the jump server to destination servers, they cannot access the destination servers directly with SSH and sudo still works for the users on the destination servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.