Our setup: LDAP server - OpenLDAP with openssh and sudo schemas. Bastion server - accepts SSH from anywhere and authenticates users via public keys stored in LDAP (using sssd) Destination server[s] - should accept SSH only from Bastion server and authenticate users via public keys stored in LDAP (using sssd)
Now this setup works and on destination server the restriction is done via sshd's
AllowUsers such as
However this has become a problem when due to IDC issues the bastion became not available. Thus rendering all servers not accessible.
As a follow up on this situation I am thinking if there is a way to perform similar restriction, but store
bastion_ip in LDAP record for a user (or in another entry), thus allowing to quickly move to another IP in case of similar situations happening.
Is there such way? Or some workaround that I haven't thought of?