Re: Howto deny a sftp connection



On 2006-01-19, Tom <teeeelo@xxxxxxxxxxxxxx> wrote:
> this is exactly the topic I have questions about.
> For me I want to archieve, that users can connect to the server by ssh
> but that they cannot transfer files from that server.

If you're allowing shell access then it's basically impossible to stop
a determined user transferring files, see below.

> Thats why I want to stop and deny all sftp and scp connections.
>
> Okay, the sftp subsystem is easily to stop by editing the sshd_config.

Unless you remove permissions from sftp-server too, users can still run
sftp over a shell channel as Richard mentioned.

> Is it somehow possible to control the scp function by pam.d? note: I
> don't want to deny ssh.

No, neither scp nor sftp check PAM.

You can block naive users by setting the permissions on the scp binary
(eg make it mode 750 with a group "scpusers", then put anyone allowed to
run it in that group) but that won't stop someone copying an scp binary
into, eg, $HOME/bin and using that.

Even if you managed to block scp and sftp perfectly, since you're allowing
shell access, files can be transferred trivially using shell output
redirects (ie ssh yourserver "cat file" >file or a gazillion variations
thereof).

--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
.



Relevant Pages

  • Re: Advantage -vs- Disadvantage: SFTP -vs- SCP
    ... SFTP is better than scp if you just want to transfer files, ... dont have to have shell access to the box to use the openssh SFTP system. ...
    (freebsd-questions)
  • Re: Advantage -vs- Disadvantage: SFTP -vs- SCP
    ... SFTP is better than scp if you just want to transfer files, ... dont have to have shell access to the box to use the openssh SFTP system. ...
    (freebsd-questions)
  • Re: How to enable file transfer for cross-platform application
    ... Doesn't scp *require* shell access on the destination? ... (sftp doesn't ...
    (comp.os.linux.misc)
  • Re: SCP on MPE 7.5?
    ... there were postings about using sftp and scp on MPE. ... now that Jazz and Invent3k are officially 'offline'. ... I've had extensive experience with the sftp client, ...
    (comp.sys.hp.mpe)
  • RE: sftp exit codes?
    ... thanks to everyone who replied with a tip or suggestion. ... Subject: sftp exit codes? ... I am using scp along with BatchMode on command line. ...
    (SSH)