Selective SFTP

[Richard kelly_2]

I'm running TCPIP 5.4 ECO 7 and I need to be able to enable inbound SFTP connections, but disable inbound interactive ssh terminal sessions (if it can be disabled selectively based on source IP that would be even better). Can that be done in this or any version of SSH on VMS?

[John Gillings]

Richard,

I'm not sure if there are any specific build-in filters to satisfy your exact requirements, but you can do anything you like from SYLOGIN or the LOGIN.COM for the incoming network process.

Source addresses are SYS$REM* logical names. Other attributes of the process and connection are available via lexical functions and/or system services. Experiment with the processes you're interested in, identify those you want to block and LOGOUT from the LOGIN.COM if detected.

One useful trick... if you want to selectively enable or disable filtering by user, GRANT an identifier to the username and use that to decide if the filtering code should be executed.

[Steven Schweda]

I know nothing, but I see nothing. I gather
that on a typical UNIX system, this sort of
thing is done by setting a user's shell to
some alternate (dummy, fatal) thing (or to
the sftp server program itself), and those
techniques would seem not to apply to VMS.

If one could find an SSH-specific condition
which could be tested in SYLOGIN.COM, then
one might be able to cram some kludgy test of
the user's name and that SSH condition into
that.

The user-name part is easy enough:
f$getjpi( "", "USERNAME")

I'm unaware of any good SSH test. It seems
to be true that SYS$REM_NODE is defined but
f$getdvi( "TT", "TT_ACCPORNAM") is null. So,
if that's true for only an SSH connection,
then perhaps ...

$!
$ bad_ssh_users = "/FRED/SMS/"
$ if ((f$locate( ("/"+ f$edit( f$getjpi( "", "USERNAME"), "TRIM")+ "/"), -
bad_ssh_users) .lt. f$length( bad_ssh_users)) .and. -
(f$trnlnm( "SYS$REM_NODE") .nes. "") .and. -
(f$getdvi( "tt", "tt_accpornam") .eqs. ""))
$ then
write sys$output "SSH session?"
$ logout
$ endif
$!

[Richard Whalen]

If this was MultiNet, then I would say to do the following:

In SSHD2_CONFIG. add the following line:

UserSpecificConfig username ssh2_dir:user_config.

In file SSH2_DIR:USER_CONFIG.

SessionRestricted subsystem

[SDIH1]

Most simple is this: put a logout command
in login.com of the sftp user. In TCP Services login.com is run when logging in using ssh, but not when logging in using sftp.