Using the lshell+ script to implement the Fortress machine (jump connection) function

Fortress Machine (jump connection) function:

Users who need to log on to the production server must first log on to this server and then log on to the production server from this server.

You can limit the use of SSH and exit commands, or write a script yourself to let the person who is logged in choose.

Here you can install the Lshell on the bastion machine (jump Connect) server to achieve various restrictions.

1. Installing Lshell Tools
GIF home: Https://github.com/ghantoos/lshell

If the bastion machine is not networked, you can download the installation files from somewhere else and copy them over.

git clone https://github.com/ghantoos/lshell.git
CD Lshell
Python setup.py install–no-compile–install-scripts=/usr/bin/

If there is no error, the installation is successful.

2, Configuration conf
Configure this file, you can achieve a good result.
Vim/etc/lshell.conf

[Default]

Allowed: [' ssh ', ' exit ']

3, change user default shell, use Lshell as default shell:
# cp/etc/lshell.conf/usr/local/etc/
# chsh-s/usr/bin/lshell user_ Name This command can only modify a user, you can write a script to bulk modify the

4. Open log
To record the user log, you need to create the relevant directory
# Addgroup–system Lshell
# Mkdir/var/log/lshell
# Chown:lshell/var/log/lshell
# chmod 770/var/log/lshell

Then add the user to the Lshell group:
# Usermod-ag Lshell user_name

# More articles See my personal site: haibing.org #

Using the lshell+ script to implement the Fortress machine (jump connection) function