I need to restrict access to many networks which I have no control over and am planning on using a jumpbox to be the single point of entry into all of the environments. A user would log in with their ldap credentials as well as their ssh key and then jump from here to a set of hosts that they are allowed to access.
The core issue is the limiting where a user is allowed to access. Since this is a shared resource where many members of our teams have access to, how do I limit this access. I thought that there might be a way with radius, but I did not see any. I would like to make this as easy as possible, i.e.
ssh -t user@jumpbox ssh user@remote_host
remote_host would be a system they are allowed access to.
My ideas are as follows:
(most resource intensive) a jumpbox per user, and manage the routes centrally through puppet as to what they are allowed access to. This would likely be the easiest to manage as it would be a VM per user.
(most painful for the users) Set up a script which is the only thing the user can run which gives them a selection. This would be a pain as the user would have to select from a potentially long list. This could also be easy to get around.
What have other people done to solve this issue?