SFTP and Restricted Shell

[yyghp]

I tried to restricted users only have access to their own home folder after they SFTP to the server, with restricted shell.

I changed the user to use "rksh" ( or "rsh" ), like this:

transfr:*:153:240:French Translator User,,,:/home/transfr:/usr/bin/rksh

( from "/usr/bin/ksh" to "/usr/bin/rksh" )

But after that, the user can't SFTP anymore:

psftp> open srs010
login as: transfr
Using username "transfr".
Password:
Fatal: unable to initialise SFTP: could not connect
psftp>

However, I don't have problem to login via SSH...

Why I can't SFTP ?
Thanks!

[yyghp]

I noticed that "/usr/bin/rksh" should not be used with ssh/sftp.

Is there any other way I can restrict users to ONLY access their own home directories after they SFTP and SSH to that HP-UX server?
Thanks!

[Steven E. Protter]

Are you possibly in a chroot environment here?

If you've done that then the binaries required for certain operations must be in the chroot directory.

More to the point, since ssh works and sftp does not, I suspect its a bug.

What version of ssh/secure shell are you using. If its not current, consider an upgrade. If it is current consider making a bug report.

There is no such thing as perfect software.

SEP

[Raj D.]

Hi yygp,

You need to setup restricted shell for that user , with /usr/bin/rsh

You may have a look at this link:

http://newfdawg.com/SHP-RestShell.htm

Cheers ,
Raj.

[Raj D.]

Hi yygp,

To restrict users only have access to their own home dir, you can setup with ftponly shell account.

Cheers,
Raj.

[Rick Garland]

Does scp work? Or pscp for putty.

[yyghp]

Hi Steven,

I think the problem is not the sshd, but the "/usr/bin/rksh" or "/usr/bin/rsh" ( I tried both to replace "/usr/bin/ksh" in /etc/passwd )

When I tried SFTP:
On client side:
psftp> open srs007
login as: transfr
Using username "transfr".
Password:
Fatal: unable to initialise SFTP: could not connect
psftp>
On Server (srs007) side: ( /var/adm/syslog/syslog.log )
Sep 16 08:45:53 srs057 sshd[13357]: Accepted keyboard-interactive/pam for transfr from 10.201.170.151 port 1212 ssh2
Sep 16 08:45:53 srs057 sshd[13403]: subsystem request for sftp

When I tried FTP:
On client side:
User : transfr
530 User transfr access denied...
Login failed.
On Server (srs007) side: ( /var/adm/syslog/syslog.log )
Sep 15 13:07:26 srs057 ftpd[1963]: FTP LOGIN REFUSED (bad shell) FROM 10.201.170.151, transfr
Sep 15 13:07:30 srs057 ftpd[1963]: FTP session closed

I think the restricted shell can't work with SSH well...

[yyghp]

Hi Raj,

I did follow that guide several days ago to setup restricted shell, it worked fine for TELNET/SSH, but had problem for FTP/SFTP, I was requested to make both SSH and SFTP working with restricted shell, in order to limit uses to access only their home directory. However, any suggestion to approach such limit without using restricted shell will be fine too...
Thanks!

[Dave La Mar]

Attached you will find the HP docs on setting up an ftponly that includes restriction to a subdirectory.
We have used this often.
Hope this helps.

Best of luck.
Regards,
dl

[yyghp]

I have asked this question here for about 2 weeks, thanks for everyone who replied, but it seems everyone tried to avoid the question I was asking, while mentioned something related...
I wonder in HP environment, can I implement directory restriction on both SFTP and SSH login? That is, can I prevent user from changing directory to the one other than their own, when they login via SFTP and SSH?
I know telnet and ftp, but how about SFTP and SSH?
I need the solution for SFTP and SSH.
I appreciate if someone can help me out. Thanks again!

[yyghp]

up!
please help!

[Victor BERRIDGE]

Hi again,

>Is there any other way I can restrict users to ONLY access their own home directories after they SFTP and SSH to that HP-UX server?
Thanks!
You cannot sftp using rksh, but since you are using ssh that is OpenSSH SSH client (remote login program), there is no point using sftp OR ftp (file transfer program) because using ssh with rksh (and as explained in previous replies how to access home directories only...) you should use scp ONLY and be sure that that account CANNOT use FTP (which he can if the shell figures in /etc/shells)
FTP was designed as FILE TRANFER PROTOCOL not for remote login... and so is used for transfering files from remote server WHERE (normally) the user has no access (other than ftp...)
Do a man of scp...
Using ssh and restricted shell (plus chroot variants..) your account can connect to the remote and is already restricted to his remote home directory now for transfering files all he has to do is use the secure remote copy utility scp and be sure he cannot use ftp (where he is allowed to change directories...)


All the best
Victor

[yyghp]

Hi Victor,

Thanks for your reply!
However, you might haven't got what I was asking, let me explain my current situation again:

In my 2nd post on the top, I have already mentioned "rksh" wouldn't work with SSH/SFTP ( rksh works for TELNET/FTP ), so, let's do not go back to the topic aobut using "rksh", on such server, we ONLY use SSH(running sshd only), no telnet, no ftp.
One of our users called "transfr" wants to use "psftp"(Putty's SFTP client) or "winscp"(GUI SFTP client) to transfer files in between his desktop and the server. So, I can't ask this user to ssh or scp, which you recommended.
Such "transfr" user now can use "psftp" and "winscp" to connect the server and transfer files, but I was asked to limit such user to stay in his own HOME directory, that is, he can't use "cd" to go to his parent directory or any other directories. How can I do it? Could you ( or anyone else ) please give me a DIRECT answer to such topic?

Another thing is that since the user "transfr" have account on the server, he/she can login via SSH ( such SSH I am using here is the term for secure telnet session, I use Putty to ssh to the server ), so, I should block him/her from accessing other directories other than his/her own Home directory, that's why I need such restriction on SSH as well.
That is, I run "sshd" on the server side, want to restrict user "transfr" only access his/her own directory, no matter the user access the directory via SSH or SFTP.

Thanks!

[yyghp]

Could anyone give me a solution?
Thanks!

[Victor BERRIDGE]

A solution?

For that we need to know what that user needs...
Why does he have access to the server ?(does he run some applications etc...)
You cant have ssh /resctricted shell AND sftp, and ftp bypasses the restricted shell...
So if he only needs to ftp (SFTP or what you want...) you have to create a chroot environment and give /usr/bin/false for shell in /etc/passwd and add /usr/bin/false as a valid shell in /etc/shells...

If he needs a connection to the box (ssh) AND needs to tranfer files from your hp to his pc and vice versa then I would try ssh/rksh combination WITH samba where you would export HIS home directory using samba so he can connect his home directoy as a network share drive under Windows AND not let him use ftp.

I do something similar here where SAS users generate output file as .csv and recuperate their file under I (network drive) using samba no ftp...
IF he doesnt need connection I would remove ssh and use only samba there he can only use and see what you defined...

All the best
Victor