How to disable sftp/scp for user connecting thru SSH?

[Stan_365]

Hello,

Is there any way to allow a user list to login system through SSH but disallow file transfering tool after this user list login the system?

My environment is: HP-UX 11iv1, HP Secure Shell A.04.30.014, a group of users have to connect to the server and run specific application thru SSH. We have tried ssh_chroot.sh to restrict this group users to access other file systems, but the chroot function is not welcomed by the application env. i.e. this group users only can run applcation without chroot. And it is too hard for us to change application configuration suitable for the chroot environment.

Thanks in advance,

Stan Du

[melvyn burnard]

Posted in wrong forum, moved to more appropriate forum

[spex]

Hi Stan,

You can disable sftp by commenting out this line:
# Subsystem sftp /opt/ssh/libexec/sftp-server
in /opt/ssh/etc/sshd_config.

I'm not sure that you can disable scp, as its functionality can always be duplicated through ssh:

ssh user@remote-host "cat > remote-file" < local-file

PCS

[Steven E. Protter]

Shalom,

You can do this with tcp wrappers, possibly.

You have to identify the daemon for scp and sftp. Hopefully its not sshd. If its not, you can totally disable it in the /etc/hosts.deny file.

If it is one daemon for all, then its may require you to write some custom code in /etc/profiles or by modifying the ssh_chroot.sh script. I'd look there and see if you can take part of its functionality without going full blown chroot.

SEP

[Stan_365]

Thanks PCS & SEP,

I have visited SSH web and got known that it is not possible to deny file transfering while connecting thru SSH. it is also impossible to allow specific user list to use sftp. So i have to give up it.

Stan

[Dennis E. James]

Just a suggestion put an acl on scp and sftp removing executable privileges for the group those users are in.