Project

General

Profile

Actions
Copy link

Task #7601

closed
NS

Setup an SSH jump host

Task #7601: Setup an SSH jump host

Added by Nico Schottelius about 6 years ago. Updated over 3 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Start date:
01/13/2020
Due date:
% Done:

0%

Estimated time:
PM Check date:

Description

  • Authenticated against our ldap
  • Allows user to connect to our IPv6 networks

The ways for users to use it:

  • via ProxyCommand (some might be able to use that)

I've setup this some time ago and it basically needs a restriction on not having a shell.
Ping me before starting on this - I've a 95% solution already.

TF Updated by Timothée Floure about 6 years ago Actions
Copy link
 #1

  • Status changed from New to Seen

NS Updated by Nico Schottelius about 6 years ago Actions
Copy link
 #2

Proxycommand w/ windows exists in putty and usually uses plink - more details soon.

TF Updated by Timothée Floure over 5 years ago Actions
Copy link
 #3

@Nico Schottelius please dump anything you want to say on the subject on this issue. I'll do without next time I go over this issue :-)

NS Updated by Nico Schottelius over 5 years ago Actions
Copy link
 #4

Very easy:

  • ssh config ("MatchUser != root") disallowing all commands
  • configuring the OS or PAM to authenticate against ldap (subtree of dc=ungleich,dc=ch)
  • Basically disallowing shell
  • nft rules to allow to jump to 2a0a:e5c0::/29 and 2a09:2940::/29

So from the outside/black box test:

  • ssh -w in ~/.ssh/config with our jump host should work
  • ssh user@jumphost should not work / close the shell

TF Updated by Timothée Floure about 5 years ago Actions
Copy link
 #5

  • Assignee deleted (Timothée Floure)

NS Updated by Nico Schottelius over 3 years ago Actions
Copy link
 #6

  • Status changed from Seen to Rejected

Not much requested - dropping it for the moment

Actions
Copy link

Also available in: PDF Atom