Home / server / Questions / 872993
In Process
MarkHelms
Asked: 2017-09-12 00:14:43 +0800 CST

How to restrict outgoing ssh traffic only to certain hosts w/o iptables

  • 772

One of our ssh servers acts as jumphost. Users are supposed to proceed only onto certain target hosts. This could be done with iptables, but for the moment this is not the desired solution.

I checked man ssh_config to see if this scenario could be configured within system-wide ssh_config, but found no hint.

Any ideas aside iptables to achieve this?

ssh

6 Answers

  1. Add a valid route to your targets and a more generic route to null. Then, only the defined routes to your targets will be available for the users. The problem is this is available for all the users

    • 1

  2. You might use something like this

    #! /bin/sh

MSG='********************************
1 = host1
2 = anotherhost
3 = host3

0 = exit
********************************'

host=none

while test none = "$host"
do
  echo "$MSG"
  echo -n 'your choice: '
  read choice
  case "$choice" in
  1) host=host1.domain.com;;
  2) host=anotherhost.xy.de;;
  3) host=just.go.here;;
  0) exit;;
  esac
done

ssh $host

    as the login shell of your ssh users on the jumphost. If you save it as /usr/bin/ssh-choice, don't forget to add /usr/bin/ssh-choice to /etc/shells.

    TomTomTom

    • 1

  3. I am not sure about the setup, but maybe disabling shell login on the jump host and allowing port forwarding to specific hosts only for specific users and then exercising -J option (ProxyJump) of openssh could be a solution here? The Match directive of the sshd_config could be of help here.

    • 1

  4. Responding to an earlier comment:

    If you need shell access then you likely need immutable and empty .ssh/config in users' home directories, all of the allowed hosts listed in /etc/ssh/ssh_config and catch all Host directive which redirects to an always failing ProxyCommand (which may also print coaching message to stderr, so the user can see it).

    Something along the lines:

    Host host1 host1.example.com
    <whatever directives may be needed here if any>

Host host2 host2.example.net
    <whatever directives may be needed here if any>

Host *
    ProxyCommand /bin/false
    • 1

  5. Remove everything but the jumphost from the routing table of the host or put the firewall that prevents connections somewhere other than the host itself.

    • 0

  6. You could hosts.allow and/or hosts.deny on the target machines.

    • 0