I want to setup a bastion for SSH and tunneling HTTP :
- let the user use a private key stored on bastion without having read access to it
- permit the use of proxyjump (or proxycommand) on the client
Use case :
- Client (employe)
- Bastion (own private key)
- ServerA, ServerB, ServerC, ... (authorize bastion key)
I want the client to connect to serve A like this :
Client ==[ldap]==> bastion ==[keys]==> serverA
I manage to do it with sudo on bastion:
# allow users to use bastion keys %users ALL=(bastion) NOPASSWD: /usr/bin/ssh
Then to connect I use, from client (with a user in users group):
alias ssh-bastion="ssh -t myuser@bastion 'sudo -u bastion /usr/bin/ssh'" ssh-bastion serverA
For authentification, it works fine.
For tunneling, it's a bit more complicated to have
ssh-bastion -L8080:localhost:8080 to work.
And for ansible, I haven't manage to make it work...
Is there a way to configure something like this in
.ssh/config of the client ?
Host serverA ProxyCommand ssh bastion -W %h:%p sudo -u bastion /usr/bin/ssh Port 22 User myuser
Note : It's not possible for the user to own the private key.