Setting up an SSH jump box to allow some outside people to access an internal server. I have the authentication stuff all working where they will use a private/public key pair to authenticate. I'll then be using IP tables to allow access to RDP to the server they need to work on. I will then have them use the tunnel feature on Putty so they will only have to do a localhost:port on RDP window once connected instead of running commands in the box. The above is all working fine.
Since these are outside people, I DO NOT want them having access to anything on the jump box at all. I simply want them to authenticate ONLY and then remote using the Windows RDP.
Right now when they authenticate, it opens the command line in putty and it needs to stay open so they can remote. My question is this. Is it possible to restrict the users to only be able to authenticate and nothing else? I do not want them to have any shell access at all. Maybe something similar to what /bin/false does EXCEPT the connection stays open to allow the RDP without them being able to even type commands.
Ideally, I would like their putty session to not work anymore except to keep the connection alive until closed. Not sure if that is possible though. I can't seem to find a straight answer anywhere either.
I am a bit new to Linux so please bear with me if anything I ask is stupid.