[HPADM] SUMMARY Restricted SFTP without user being able to SSH into server

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Date: Fri, 1 Apr 2005 10:42:47 -0500
To: <hpux-admin@dutchworks.nl>

While I managed to get a few replies from the list that suggested
scponly, they suggestions did not fit the desired security level. I did
amazingly get a simple and workable solution from HP. I have added it
here so that it will assist others that may have to perform the same
configuration:

1. Setup a chroot environment for sftp.
http://www.docs.hp.com/en/T1471-90014/ch01s13.html

2. Setup script logging to allow only the sftp-server process to be a
valid app for login.

#!/bin/sh

#

# sftponly shell

#

# Shell arguments must be -c /opt/ssh/libexec/sftp-server echo $1 >>
/tmp/ftponly.log if [ "$1" != "-c" -o "$2" !=
"/opt/ssh/libexec/sftp-server" ]

   then

   echo "Error: sftpshell only runs the sftp-server program."

   exit 1

   fi

shift 2

 /opt/ssh/libexec/sftp-server $*

For the above script to work you would have to create an account with
this script as the shell for the account. Here is an example;

sftponly:ZDsDOEvJmtJw.:144:20::/home/sftponly:/tmp/sftponly.sh

The setup works like a champ and resolved the issue.

   -Jim

Original Message:

We are migrating to servers where security policy dictates secure ftp
sessions only. In the past we just used restricted FTP with the user's
shell prompt set to /bin/false or /etc/ftponly.

When I do an sftp to that server, I get a message "illegal user XYZ from
ip ..." and the access is denied. When I set the shell to /bin/sh, I
can sftp into the server, but it is not directory restricted to their
home directory. Also, the user can use SSH to login to the server,
which is most undesirable.

I have dug around on man pages, Googled, and looked at OpenSSH.org, but
cannot find out a way to configure the sshd or sftp to make sftp work
like restricted FTP.

   Thanks

   -Jim

--
             ---> Please post QUESTIONS and SUMMARIES only!! <---
        To subscribe/unsubscribe to this list, contact majordomo@dutchworks.nl
       Name: hpux-admin@dutchworks.nl     Owner: owner-hpux-admin@dutchworks.nl
 
 Archives:  ftp.dutchworks.nl:/pub/digests/hpux-admin       (FTP, browse only)
            http://www.dutchworks.nl/htbin/hpsysadmin   (Web, browse & search)

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]