Re: ftp access

From: Steve Reid (sreid@sea-to-sky.net)
Date: 02/28/01 

Date: Tue, 27 Feb 2001 20:21:45 -0800
From: Steve Reid <sreid@sea-to-sky.net>
To: Brooks Davis <brooks@one-eyed-alien.net>

On Tue, Feb 27, 2001 at 02:55:12PM -0800, Brooks Davis wrote:
> If you do this be sure to keep users from being able to access the system
> via ssh. Otherwise they can just use ssh to spawn a shell for themselves:
> ssh -t <host> /bin/sh

Are you certain about this?

I tried this on a 4.1.1-R box I operate and it didn't let me in. The
box is set up with the ftp login shell set to "/nonexistent/ftponly",
which is listed in /etc/shells but does not exist.

I suspect sshd is trying to use the login shell to execute the supplied
command, which will fail if the login shell doesn't exist.

Either I'm not doing it right, or other ssh/sshd combinations are
different, or you're wrong about it being possible.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • SUMMARY: how to set correct path?
    ... ven if we login with ssh. ... For BASH login shell, place the system wide ENV variables, such as PATH, ... You can set Use_login in the sshd_config to yes and restart sshd. ...
    (SunManagers)
  • Re: Detailed logging of ssh sessions
    ... >via ssh). ... come in some way from the login shell. ... I'd just experiment with using script in some way ...
    (freebsd-questions)
  • ERRATA : interactive and login shells: bug or design decision ?
    ... when I execute: <ssh user@somesite.com command>, ... but I am expecting my command to run under a login shell. ...
    (SSH)
  • RE: sftp virtual users question
    ... I create the uid with "no login shell". ... They can scp, but they can't ... 2.Is it possible to manage users independently for ssh and sftp ... 3.Documentation about sftp-server subsystem is very poor? ...
    (SSH)