I have the following setup in my network:
Internet <--> Bastion <--> Local Network
I have several users and each user is assigned to a specific machine. Or in other words: Each user must have only access to one of those servers. E.g.: User1 --> Machine1, User2 --> Machine2 and so on.
Those users will connect from the outside of my network and I have considered many options how to forward their connects via my bastion host to my network.
Eventually I opted for Match Blocks and forcecommand.
So, my /etc/ssh/sshd_config on bastion looks like this:
Match User User1 ForceCommand ssh User1@Machine1 $SSH_ORIGINAL_COMMAND
User1 connects to bastion host which automatically establishes a connection with Machine1.
As far as I understood ForceCommand, User1 won't have any real access to the bastion host, because all of his operations will be handled by the match block first, hence rerouted to Machine1. However is this really true? Is this already enough to be a secure setup? The user is jailed on Machine1 anyway, so he won't have many possibilities there.