allow tcp forwarding; disable shell access; remove rsync

Dockerfile

@@ -1,6 +1,6 @@
-FROM alpine:3.8
+FROM alpine:3.9
 
-RUN apk add --no-cache rsync rrsync openssh-server
+RUN apk add --no-cache openssh-server
 
 ENV SSHD_HOST_KEYS_DIR /etc/ssh/host_keys
 VOLUME $SSHD_HOST_KEYS_DIR

README.md

@@ -1,31 +1,34 @@
-# docker: openssh-server restricted to rsync 🐳
+# Docker: OpenSSH-Server Restricted to TCP Forwarding 🐳
 
-repo: https://github.com/fphammerle/docker-rsync-sshd
+Docker Hub: https://hub.docker.com/r/fphammerle/ssh-bastion
 
-docker hub: https://hub.docker.com/r/fphammerle/rsync-sshd
+## Example: Share Web Server
-
-SSH clients are restricted to `rsync --server` commands via [rrsync](https://download.samba.org/pub/unpacked/rsync/support/rrsync).
-
-rrsync prefixes `/data` to all paths (e.g., `rsync ... host:/src /backup` downloads `/data/src`).
-
-## example 1
 
 ```sh
-$ docker run --name=rsync-sshd -p 2022:22 -e USERS=alice,bob -v rsync-data:/data:ro fphammerle/rsync-sshd
+bastion $ docker run --name ssh-bastion -p 2222:22 -e USERS=alice,bob fphammerle/ssh-bastion
-$ docker cp alice-keys rsync-sshd:/home/alice/.ssh/authorized_keys
+bastion $ docker cp alice-keys ssh-bastion:/home/alice/.ssh/authorized_keys
-$ docker cp bob-keys rsync-sshd:/home/bob/.ssh/authorized_keys
+bastion $ docker cp bob-keys ssh-bastion:/home/bob/.ssh/authorized_keys
+alice $ ssh -N -R 28080:localhost:8080 -p 2222 bastion
+bob $ ssh -N -L 8081:localhost:28080 -p 2222 bastion
+bob $ curl http://localhost:8081/hello_bob.html
 ```
 
-## example 2
+## Example: SSH Jump Host
 
 ```
-$ docker run --name rsync-sshd \
+$ docker run --name ssh-bastion \
     --publish 2022:22 --env USERS=alice,bob \
-    --volume accessible-data:/data:ro \
+    --volume bastion-host-keys:/etc/ssh/host_keys \
-    --volume host-keys:/etc/ssh/host_keys \
+    --volume alice-ssh-config:/home/alice/.ssh:ro \
-    --volume alice-ssh-config:/home/alice/.ssh:ro \ 
+    --volume bob-ssh-config:/home/bob/.ssh:ro \
-    --volume bob-ssh-config:/home/bob/.ssh:ro \ 
     --init --rm \
-    fphammerle/rsync-sshd
+    fphammerle/ssh-bastion
-$ rsync -av --rsh='ssh -p 2022' alice@localhost:/source /target
+$ ssh -N -R 20221:localhost:22 -p 2022 alice@bastion
+$ ssh -J bob@bastion:2022 -p 20221 localhost
 ```
+
+### Docker Compose 🐙
+
+1. `git clone https://github.com/fphammerle/docker-ssh-bastion`
+2. Adapt `$USERS` and paths in [docker-compose.yml](docker-compose.yml)
+3. `docker-compose up`

docker-compose.yml

@@ -0,0 +1,18 @@
+version: '2'
+
+volumes:
+  host_keys:
+
+services:
+  ssh_bastion:
+    build: .
+    image: fphammerle/ssh-bastion
+    environment:
+      USERS: alice,bob
+    volumes:
+    - host_keys:/etc/ssh/host_keys:rw
+    ports:
+    - '0.0.0.0:2222:22'
+    restart: unless-stopped
+
+# https://docs.docker.com/compose/compose-file/compose-file-v2/

entrypoint.sh

@@ -14,6 +14,7 @@ IFS=','
 for USER in $USERS; do
     if ! id "$USER" 2>/dev/null >/dev/null ; then
         (set -x; adduser -D "$USER")
+        # TODO remove:
         passwd -u "$USER" 2>/dev/null
     fi
 done

rsnapshot.conf.example

@@ -1,32 +0,0 @@
-config_version	1.2
-
-snapshot_root	/tmp/rsnapshot/
-
-# do not create $snapshot_root
-#no_create_root	1
-
-cmd_cp		/bin/cp
-cmd_rsync	/usr/bin/rsync
-cmd_ssh	/usr/bin/ssh
-
-retain	alpha	16
-retain	beta	8
-retain	gamma	8
-retain	delta	8	
-
-# 1     Quiet           Print fatal errors only
-# 2     Default         Print errors and warnings only
-# 3     Verbose         Show equivalent shell commands being executed
-# 4     Extra Verbose   Show extra verbose information
-# 5     Debug mode      Everything
-verbose		3
-
-# prevent two instances from running simultaneously and
-# potentially messing up $snapshot_root
-lockfile	/tmp/rsnapshot.pid
-
-ssh_args	-p 2022
-
-sync_first	1
-
-backup	alice@localhost:/		data-volume

sshd_config

@@ -10,15 +10,17 @@ Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.
 MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
 
 PermitRootLogin no
+PubkeyAuthentication yes
 PasswordAuthentication no
 StrictModes no
 # separated by spaces
 AllowUsers _
 
-ForceCommand /usr/bin/rrsync /data
+ForceCommand /bin/false
 AllowAgentForwarding no
-AllowTcpForwarding no
+AllowTcpForwarding all
 GatewayPorts no
+PermitTunnel no
 X11Forwarding no
 PermitUserEnvironment no
 PermitTTY no