topic Re: sftp without a shell in Operating System - HP-UX

sftp without a shell

William Harris_3 — Wed, 07 May 2003 21:58:22 GMT

i want to only allow sftp ability to users.

i currently have openSSH with chroot patch installed.

i would like for a user defined as follows to be able to sftp:

cctest:xxx:100:200:comment:/home/user/./cctest:/usr/bin/ftponly

thanks in advance,

chris

Re: sftp without a shell

Christian Gebhardt — Thu, 08 May 2003 04:44:16 GMT

Hi

you have to give the user the sftp-server as login-shell:

cctest:xxx:100:200:comment:/home/user/./cctest:/opt/openssh2/libexec/sftp-server

(this is my PATH to the sftp-server)

Chris

Re: sftp without a shell

Christian Gebhardt — Thu, 08 May 2003 04:54:36 GMT

I forgot: To restrict the users to their home you can use chroot of course.

Chris

Hint:
http://www.linuxquestions.org/questions/showthread.php?s=&threadid=46874&highlight=chroot+ssh

Re: sftp without a shell

U.SivaKumar_2 — Thu, 08 May 2003 05:04:56 GMT

Hi,

Iam using rssh for that purpose.

http://www.pizzashack.org/rssh/index.shtml

regards,

U.SivaKumar

Re: sftp without a shell

Balaji N — Thu, 08 May 2003 05:04:59 GMT

hi

not sure with sftp, but this is what we do for ftp only users. the same logic can be applied for sftp as well.

1. add /usr/bin/passwd to /etc/shells.
2. user /usr/bin/passwd as the shell for all ftp only users.

with this, in case the user needs to change passwd, he telnets to the server and after he logins, he is forced to change the password (if required).

-balaji

Re: sftp without a shell

Tim Maletic — Thu, 08 May 2003 18:36:01 GMT

Christian's method (of using sftp-server as the login shell) will work, but I believe you'll need to build openssh (and hence openssl and zlib) statically. I.e., for the openssh build, you would do:

./configure --with-ldflags="-static" [other options]