lpnhe/ssh-rbash repository overview

Secure ssh proxy based on debian buster.

Users are chrooted in a rbash shell where only ssh command is authorized.

Use you own sssd config and ldap auth (if configured in sssd).

List of users which can log with a normal bash can be passed in env.

Can export /var/log/auth.log for analysis with fail2ban.

Can use shared homedir for users.

Root login disabled.

Can be launch with : docker run --detach \
--log-driver syslog \
--mount type=bind,source=<path to shared homes>,target=/home \
--mount type=bind,source=<path to ldap.conf>,target=/etc/ldap/ldap.conf \
--mount type=bind,source=<path to sssd.conf>,target=/etc/sssd/sssd.conf \
--mount type=bind,source=<path to ldap_certificats.pem>,target=/etc/ldap/certificats/certificats.pem \
--mount type=bind,source=<path to auth.log>,target=/var/log/auth.log \
--name=ssh \
--hostname=ssh-proxy \
-e allowedusers='john|alan' \
lpnhe/ssh-rbash