scp +sftp only configuration

[Prashant Zanwar_4]

I have ssh2 installed, what I am able to configure is ssh-dummy-shell and chroot for a user on my host which effectively restricts user to sftp..
I want some way where I can allow user scp/sftp & not ssh shell functions.. is it possible? does some one have it working anywhere?

Thanks and regards
Prashant

[Steven E. Protter · Accepted solution]

Shalom Prashant,

If you are using chroot, copy the scp/sftp binaries to each users bin directory, make sure its on the path and you are done.

Effectively, if you can't find ssh, you can't use it. chroot does a good job on that.

SEP

[Prashant Zanwar_4]

I am sorry, but it works otherwise too.. I tested it & scp shows up fine..
Thanks again
Prashant

[Tom Ward_1]

Hello Prashant,

If you allow the users to put files in their home directory then there's nothing to stop them from using scp to copy an ssh binary into thier home dir.

I was tempted to offer putting "exit 0" in the .profile file, but with SCP access they can replace it with another one that is not restricted.

Just be sure that the users can't change or add to your secured configuration effectively undoing your restrictions.

Good luck,
Tom

[Russ Park]

Hi,
question for the original poster, or anyone who wishes to reply:

Tru64's ssh implementation includes a file in /bin called "ssh-dummy-shell" but I cannot find an HPUX equivalent on my system with A.4.10 ssh.

How do I configure?

Thanks,

Russ

[Ivan Ferreira]

The authorized_keys file has the command="command" option. You could use that option for the user's key to restrict the user.