sftp without a shell

[William Harris_3]

i want to only allow sftp ability to users.

i currently have openSSH with chroot patch installed.

i would like for a user defined as follows to be able to sftp:

cctest:xxx:100:200:comment:/home/user/./cctest:/usr/bin/ftponly

thanks in advance,


chris

[Christian Gebhardt · Accepted solution]

Hi

you have to give the user the sftp-server as login-shell:

cctest:xxx:100:200:comment:/home/user/./cctest:/opt/openssh2/libexec/sftp-server

(this is my PATH to the sftp-server)

Chris

[Christian Gebhardt]

I forgot: To restrict the users to their home you can use chroot of course.

Chris


Hint:
http://www.linuxquestions.org/questions/showthread.php?s=&threadid=46874&highlight=chroot+ssh

[U.SivaKumar_2]

Hi,

Iam using rssh for that purpose.

http://www.pizzashack.org/rssh/index.shtml

regards,

U.SivaKumar

[Balaji N]

hi

not sure with sftp, but this is what we do for ftp only users. the same logic can be applied for sftp as well.

1. add /usr/bin/passwd to /etc/shells.
2. user /usr/bin/passwd as the shell for all ftp only users.

with this, in case the user needs to change passwd, he telnets to the server and after he logins, he is forced to change the password (if required).

-balaji

[Tim Maletic]

Christian's method (of using sftp-server as the login shell) will work, but I believe you'll need to build openssh (and hence openssl and zlib) statically. I.e., for the openssh build, you would do:

./configure --with-ldflags="-static" [other options]