Users logged in on my Linux server should be able to ssh to a specific remote machine with a default account. The authentication on the remote machine uses public key, so on the server the corresponding private key is available.
I don't want the server users to actually be able to read the private key. Basically, the fact that they have access to the server allows them the ssh right, and removing them from the server should also disallow connection to the remote machine.
How can I allow users to open an ssh connection without giving them read access to the private key?
My thoughts so far: obviously the ssh executable must be able to read the private key, so it must run under another user on the server which has those right. Once the ssh connection is established, I can then "forward" it to the user so that he can enter commands and interact with the remote machine.
- Is this a good approach?
- How should I implement the forward?
- How can the user initiate the connection (that is, the execution of the ssh by the user which has read rights on the key)?
- Is there a security loophole? - if the users can execute an ssh as another user, can they then do everything that other user could (including, reading the private key)?