Re: Howto deny a sftp connection

On 2005-12-20, Richard E. Silverman <res@xxxxxxxx> wrote:
>>>>>> "HK" == Hermann <kein@xxxxxxxx> writes:
>
> HK> Hey guys, how can I deny a login via scp, sftp or a winscp
> HK> connetion? I only know, that this is a non-interactive
> HK> connection. What are the parameters for the sshd.conf?
>
> You can turn off the usual sftp by removing the sftp subsystem from
> sshd_config. However, there is no easy general way to prevent scp, since
> it is simply a remote command (and in fact, one can get sftp to work the
> same way).

You could remove execute permissions from the sftp-server and scp binaries
(or make them group-execute only for a certain group) but that still
won't stop people transferring files via other means (eg "ssh server
cat /foo/bar >bar").

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
.

Relevant Pages

  • Re: FTP Encryption
    ... SSH as a transport in different ways, ... OpenSSH's sftp certainly doesn't use scp in any way. ... Good judgement comes with experience. ...
    (comp.security.ssh)
  • RE: sftp exit codes?
    ... thanks to everyone who replied with a tip or suggestion. ... Subject: sftp exit codes? ... I am using scp along with BatchMode on command line. ...
    (SSH)
  • Re: puTTY to Windows 200k W/ OpenSSH OK; SFTP not OK
    ... > now trying to either do scp through WinSCP or SFTP through SecureFX. ... Good judgement comes with experience. ...
    (comp.security.ssh)
  • Re: Does OpenSSH use RCP?
    ... > with someone about the difference between OpenSSH and SFTP. ... > SFTP) than SCP will fail. ... OpenSSH uses an implementation that is compatible to the original SSH ...
    (comp.security.unix)
  • Re: SFTP and SCP
    ... > Both scp and sftp use insecure protocols which derive their security from ... In what way do you see sftp as having "improved ... with wildcard expansion. ... matching rules chosen by the server. ...
    (comp.security.ssh)