I basically want to do what is explained in this serverfault question, so I want a group of people ("admins") be able to login in to many hidden servers with
ssh using a jumpbox which stores the private keys for the hidden servers.
As updating the
authorized_keys on the hidden servers is rather expensive, I only want to control access to them by modifying the jumpbox, i.e. add or remove "admins" by changing the
authorized_keys file on the jumpbox.
What I especially do not want is to leak the private keys stored on the jumpbox to the admins, so the ssh-agent+ProxyCommand approach mentioned in the linked question's answers won't work because the agent would send the private keys from the jumpbox to the "admins", if I understand that right.
On the contrary, simply doing
ssh -tt jumpbox ssh hidden_server_1
has the drawback that "admins" can't use
scp and port forwarding easily.
NB: Shell access to the jumpbox shall be disabled for "admins" by using a custom script as login shell that only allows the necessary commands.
Is there any secure & convenient way to keep the comfort of
scp and port forwarding without weakening the security constraints?
Thank you very much for your help!