I have a private network of Centos 7 servers. Each of the servers can only be reached via an SSH bastion. Furthermore, all of these servers use SSSD to authenticate SSH users' keys against an LDAP directory.
Because keys are authenticated against an LDAP directory, there isn't a standard
authorized_keys file. Instead of a standard
authorized_keys file, the binary
/usr/bin/sss_ssh_authorizedkeys pipes a query against LDAP to
sshd formatted as an
authorized_keys file--but not actually as a file. So, limiting users to particular commands by binding RSA keys to
commands=" ... " entries is not possible, as far as I know.
SSH users are able to authenticate through the bastion to their workstations using the following command:
ssh -A -l firstname.lastname@example.org joes.workstation.ip -o ProxyCommand="ssh -l email@example.com -q bastion.ip nc joes.workstation.ip %p"
Unfortunately, they are also able to SSH into a session on the bastion server, something I would not like them to be able to do.
Is there anyway I can use my current tools--SSSD, SSHD, an LDAP directory--to allow SSH users through the bastion, but not into the bastion?