Ygtjki

I'm trying to set up a way for users to connect to the same gateway server for SSH/SFTP (SFTP a priority, SSH nice to have) and have that gateway server route the users to private servers inside my network identified by username and the private host they want to reach. This has to be a seamless user experience, i.e - no special config file setup, no flags for command line sessions, and no special setting in UI tools like Filezilla.

What I managed to do so far is add this block to my sshd_config file in the gateway server:

Match User someuser 
 ForceCommand sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server

Now this works great when I'm doing this from a client machine:

ssh -i id_rsa someuser@gateway_server_machine

it will trigger the ForceCommand and give me an SFTP session to the some_other_server machine.

BUT

When I do sftp -i id_rsa someuser@gateway_server_machine

the connection hangs and eventually terminated.

so, the sftp doesn't give anything even with verbose - just hangs there - but this is what I get from the server side:

debug1: subsystem: internal-sftp
Starting session: forced-command (config) 'sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server ' for someuser from 10.16.2.149 port 58822 id 0

on SSH I get:

Starting session: forced-command (config) 'sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server ' on pts/1 for someuser from 10.16.2.149 port 33550 id 0
debug1: Setting controlling tty using TIOCSCTTY.

I need to figure out what am I doing wrong here, or if there is a better way to provide this kind of connection to my users.

ForceCommand sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server

The above will start SFTP client on the intermediate server with its textual interface. Your local SFTP client (sftp or any other) cannot talk to that. It needs binary SFTP protocol. That also explain why ssh seeming works as sftp client. But it does not. It just pipes the textual interface of the sftp client on the intermediate server.

What you need is something like:

ForceCommand ssh -s sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server

That makes the (most) remote server start SFTP server (-s sftp) and the intermediate server to pipe the binary SFTP protocol to and back (ssh just pipes the binary input/output of remote sftp-server, the same way as in your setup the local ssh pipes textual input/output of intermediate sftp).

But if you need both SFTP and SSH you will need to use Subsystem directive for SFTP, not ForceCommand:

Subsystem sftp ssh -s sftp -i /home/someuser/.ssh/id_rsa someuser@some_other_server

Or to avoid having to repeat the tunneling separately for SSH and SFTP, you can use SSH_ORIGINAL_COMMAND environment variable to decide whether to use -s sftp or not.

If you actually know that the (most) remote SFTP server has OpenSSH too and the same path to sftp-server binary as the intermediate server, this should cover both SSH and SFTP:

ForceCommand ssh -i /home/someuser/.ssh/id_rsa someuser@some_other_server $SSH_ORIGINAL_COMMAND