Disable ssh but enable sftp for certain users?

[Geoff Wild]

Is there a way to configure ssh so that certain users have sftp only?

I know with the security product I'm using allows that granularity - but what about vanilla openssh and/or HP Secure Shell?

The only option I see is to chroot the users...which isn't a bad idea at all...

http://www.brandonhutchinson.com/chroot_ssh.html

Rgds...Geoff

[Steven E. Protter]

Shalom Geoff,

Let me propose a very simple way.

user and group permissions.

Create a group called sftpusers

Add the chosen users to the group who will be permitted sftp

Change ownership of sftp to the group, or make only sftpusers and root capable of executing the file.

Sounds to me like chroot is more fun, but group permissions would also work if chroot is not an option.

SEP

[Jannik]

Hey Geoff

I don't know if this is what you are looking for, but U can add restrictions to the authorized_keys file.
from="server.domain.id",no-pty,command="scp -f /home/cfg2html/*cfg.html" ssh-dss AAAAB3Nz...user@server

This would not allow other things than to cofy one specific file to a specific server. Even if you try something else it will rewrite the command and only copy that file.

Regards,
Jannik

[Ivan Ferreira]

I did this once, but I don't remember exactly, I think that is like this:

Create a script called /usr/local/sbin/ssh-dummy-shell, it should look like this:

if [ "$SSH_ORIGINAL_COMMAND" = "/usr/libexec/openssh/sftp-server" ]
then
/usr/libexec/openssh/sftp-server
else
echo "Restricted"
fi

Edit the user's authorized_keys file and add the following before the key:

command="/usr/local/sbin/ssh-dummy-shell"

[Prashant Zanwar_4]

Chroot, and then copy that binary in user path which you want them to execute. .

chroot is ssh-dummy-shell as user's shell..

and configure

ChRootUsers fgmacuwc,fgmacr3,fgmacre

Line in sshd2_config in /etc/ssh2..

Hope this helps
Tx
Prashant

[Prashant Zanwar_4]

Chroot, and then copy that binary in user path which you want them to execute. .

chroot is ssh-dummy-shell as user's shell..

and configure

ChRootUsers fgmacuwc,fgmacr3,fgmacre

Line in sshd2_config in /etc/ssh2..

But again user will be able to put any file under his home.. :-)

Hope this helps
Tx
Prashant

[Prashant Zanwar_4]

ChRootUsers will continue with your user names instead.. and sshd you have to restart once or a HUP is enough
Tx
Prashant

[Denver Osborn]

Have you considered changing the users shell to /opt/ssh/libexec/sftp-server

-denver

[Geoff Wild]

Looks like chroot is the most secure way to go.

Even with changing a user's default shell to sftp - they can still navigate anywhere on the server...

Thanks for all the answers...

Rgds...Geoff

[Patrick Sweeney (PAC)]

Geoff -

You might take a look at scponly. It secures transfers to a chrooted jail without having to give a full-blown SSH login. We've been using it for a few years now.

http://www.sublimation.org/scponly/

8-)

- Patrick