topic Re: restrict sftp commands in Operating System - Linux

restrict sftp commands

MikeL_4 — Wed, 13 Jan 2010 20:04:08 GMT

I am currently running openssh-4.3p2-36.el5_4.2, on Red Hat 5.3 server.

Is there a way to restrict the commands that are available to SFTP users.. For example, "put, get, mput, mget, mkdir,
rmdir, and rm".

I have seen many posts concerning chroot which I have set up, but none of these addresses restricting the commands actually available inside of SFTP subsystem.

Any insight would be greatly appreciated.

Re: restrict sftp commands

Ivan Ferreira — Wed, 13 Jan 2010 21:04:08 GMT

I think is not possible with sftp. Maybe you can use vsftpd with SSL enabled and configure the cmds_allowed option. You only need a SSL enabled ftp client and you connection will be encripted.

Re: restrict sftp commands

Steven Schweda — Wed, 13 Jan 2010 23:14:01 GMT

> Is there a way to restrict the commands
> [...]

I know of none, but that proves little.

What, exactly, are you trying to stop from
happening? (And why would disabling
particular commands be the best or only way
to do that?)

Re: restrict sftp commands

J. Maestre — Thu, 14 Jan 2010 11:38:35 GMT

That functionality is not implemented in sftp. There are some utils that restrict what users can do on ssh/sftp (like authprogs and scponly) but I'm not sure they will actually do what you want.

Your best bet would be playing with ACLs.

Re: restrict sftp commands

MikeL_4 — Thu, 14 Jan 2010 17:42:55 GMT

Thanks