This projects try to simplify the way you do a SSH jail to limit the resources (software / files) that SSH users can access on a server.

A sshail is a docker container running SSH inside and some directories mounted in order to limit the software and visiblilty of the user inside the container, just like an SSH jail but easier to configure.

Also you can have virtual users only aviable in the sshail mapped to real users outside the container so you can manipulate the files and permissions easy.

The sshails are destroyed daily for security and avoiding resouce exhaustion.

The user requests a sshail to server1.example.com:

curl https://myuser@server1.example.com:1934/ssh

It will respond with something like:

ssh myuser@server1.example.com -p 12200 # Valid until yyyy-mm-dd hh:mm:ss

First of all you will need docker installed properly on your system. Visit the official documentation to do that.

On Debian based systems you can install the debrequirements.txt with apt if you want to avoid installing them with pip3.

apt install $(curl https://raw.githubusercontent.com/APSL/sshail/master/debrequirements.txt | sed ':a;N;$!ba;s/\n/ /g')

Of course you can alse make a virtualenv and install requeriments.txt

Then install sshail:

pip3 install -U git+https://github.com/APSL/sshail.git

Configure (if you want to do it automagically):

sshail --deploy # As Root

This script will: - Create the /etc/sshail directory for configurations - Add a user on the system called sshail with permissions to manage Docker - Deploy a systemd configuration to start sshail with service sshail start - Deploy a cron to kill periodically the sshails

If sshail --deploy does not meet your system you can do it by hand.

The main SSHail configuration file for general application settings.

SSHAIL_PORT=1958
SSHAIL_SSH_HOST="127.0.0.1"
SSHAIL_DAILY_PURGE_TIME="04:00"
SSHAIL_PORT_RANGE="12200-12299"

At this file you can specify a list of the enabled sshails.

sshails:
    -
        user: mike
        real_user: test1
        basic_passwd: "123"
        user_crypt: '$6$aOoiKGBC$Ap1U9EFSmgPqZRgrbwbvQEqFjqGlTJ5OOJ5WvVxw7WYXhDzukUETlCvyo0iPkFzIHWgNKfQ227VuBcyyyyyyyy'
    -
        user: bob
        real_user: test2
        basic_passwd: "456"
        user_crypt: '$6$aOoiKkBC$Ap1U9EFSmgPqZRgrbwbvQEqFjqGlTJ5OOJ5WvVxw7WYXhDzukUETlCvyo0iPkFzIHWgNKfQ227VuBcwzzzzzzz'
        virt_home: '/var/www/users/bob'