Roxedus

Set up a ssh tunnel only user

In order to give someone access to hosts that are available only by ssh "bouncing" (ProxyJump), add a user for this specific purpose.

We have an internal openstack where instances get IPs on per-tenant networks. Each tenant has a 'bastion' host that has a "public" ip (floating ip). You can access other instances by bouncing through the bastion. From time to time I want to let someone else into an instance. This could be done either with:

a.) just give them shell access to the bastion and let them hop through. Sharing an unrestricted shell account on my bastion is less than ideal. b.) assign a floating/"public" IP to the instance so they could go directly in. Floating IPs are limited, so this is less than ideal.

So instead, I have set up a single user as described here that can only be used for ProxyJump. It allows others proxied access to my instances but without granting them full shell access.

	HTTP/1.0 503 Service Unavailable
	Cache-Control: no-cache
	Connection: close
	Content-Type: text/html

	<html lang="en">
	<head>
	<title>Under maintenance</title>
	<style>
	@charset "utf-8";

	#!/bin/bash

	join_by() {
	local IFS=","
	echo "$*"
	}

	get_data() {
	local QUERIES=$(join_by "$@")
	while read -d "," VALUE REST; do

	<NotepadPlus>
	<UserLang name="Dockerfile" ext="Dockerfile" udlVersion="2.1">
	<Settings>
	<Global caseIgnored="no" allowFoldOfComments="no" foldCompact="no" forcePureLC="1" decimalSeparator="0" />
	<Prefix Keywords1="no" Keywords2="yes" Keywords3="no" Keywords4="no" Keywords5="no" Keywords6="no" Keywords7="no" Keywords8="no" />
	</Settings>
	<KeywordLists>
	<Keywords name="Comments">00# 01 02 03 04</Keywords>
	<Keywords name="Numbers, prefix1"></Keywords>
	<Keywords name="Numbers, prefix2"></Keywords>