Setting up an SSH jump box to allow some outside people to access an internal server. I have the authentication stuff all working where they will use a private/public key pair to authenticate. I'll then be using IP tables to allow access to RDP to the server they need to work on. I will then have them use the tunnel feature on Putty so they will only have to do a localhost:port on RDP window once connected instead of running commands in the box. The above is all working fine.

Since these are outside people, I DO NOT want them having access to anything on the jump box at all. I simply want them to authenticate ONLY and then remote using the Windows RDP.

Right now when they authenticate, it opens the command line in putty and it needs to stay open so they can remote. My question is this. Is it possible to restrict the users to only be able to authenticate and nothing else? I do not want them to have any shell access at all. Maybe something similar to what /bin/false does EXCEPT the connection stays open to allow the RDP without them being able to even type commands.

Ideally, I would like their putty session to not work anymore except to keep the connection alive until closed. Not sure if that is possible though. I can't seem to find a straight answer anywhere either.

I am a bit new to Linux so please bear with me if anything I ask is stupid.


You can take a look at bash's restricted mode, and use it as the users' login shell.

From GNU's website:

If Bash is started with the name rbash, or the --restricted or -r option is supplied at invocation, the shell becomes restricted. A restricted shell is used to set up an environment more controlled than the standard shell. A restricted shell behaves identically to bash with the exception that the following are disallowed or not performed:

  • Changing directories with the cd builtin.
  • Setting or unsetting the values of the SHELL, PATH, ENV, or BASH_ENV variables.
  • Specifying command names containing slashes.
  • Specifying a filename containing a slash as an argument to the . builtin command.
  • Specifying a filename containing a slash as an argument to the -p option to the hash builtin command.
  • Importing function definitions from the shell environment at startup.
  • Parsing the value of SHELLOPTS from the shell environment at startup.
  • Redirecting output using the >, >|, <>, >&, &>, and >> redirection operators.
  • Using the exec builtin to replace the shell with another command.
  • Adding or deleting builtin commands with the -f and -d options to the enable builtin.
  • Using the enable builtin command to enable disabled shell builtins.
  • Specifying the -p option to the command builtin.
  • Turning off restricted mode with set +r or set +o restricted.

By the way, I'm not sure that a jump box with SSH tunnels is ideal for your use case. Maybe you should consider hosting a private VPN server to allow people from external networks to access your internal servers.

I would recommend SoftEther VPN server because it is lightweight, powerful, and really easy to configure. The configuration process of the server is also consistent across different platforms and operating systems that you might choose to use.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.