Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup a SSH Jumpbox. Users logged on the Jumpbox needs to be able to authorize to another SSH servers depending on their group.

(UserA is on group Project1, UserB is on group Project2, UserA should be able to ssh into, but not UserB)

Is there any way to implement this on the Jumpbox level?

share|improve this question
Are you asking how to ensure that UserA can ssh into, or how to prevent userB from doing so? They are two different questions. – MadHatter Jul 23 '12 at 12:35
I would like to prevent any users except those belonging to the project1 group connecting to Actually some kind of having a private key for the group on the Jumpbox and adding corresponding public key to the would be perfect for me. – yigit Jul 23 '12 at 12:44
up vote 7 down vote accepted

Assuming the jumpbox is a linux box, iptables can usefully be used on the OUTPUT chain to restrict which group members can connect to which servers. Something like

iptables -A OUTPUT --gid-owner project1 -p tcp --dport 22 -d -j ACCEPT
iptables -A OUTPUT --gid-owner project1 -j REJECT
iptables -A OUTPUT --gid-owner project2 -p tcp --dport 22 -d -j ACCEPT
iptables -A OUTPUT --gid-owner project2 -j REJECT

which has the handy side-effect of restricting the members of group project1 from doing anything except ssh'ing to, and similarly for project2 and You may also need some corresponding rules in the INPUT chain, if you restrict INPUT traffic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.