Re: scponly, allowing sftp and denying ssh access

lb.centaur@xxxxxxxxx wrote:
> We want to restrict a bunch of users to ftp/sftp access only and deny
> shell access on a Solaris 10 system.
>
> The old trick used for restricting traditional FTP access only was to
> assign users the shell /bin/false. That won't work for ssh and sftp.
>
> I've read a few posts about using "scponly" as a default user shell
> which prohibits user shell access but allows sftp and ftp access. A
> December 2005 security advisory mentioned that scponly had a security
> problem passing shell arguments thereby allowing a root compromise. The
> alert suggested upgrading to version 4.3 (?).
>
> Does anyone have experience with scponly or have other recommendations
> for restricting shell access on Solaris 10? We don'twant to create
> individual RBAC user profiles but would consider assigning all these
> users a common shell in /etc/passwd.
>
> Thanks.
>
> matthew black
> california state university
>

Put this in the /etc/profile script...

#Disable psoft user direct log in

WHO=`who am i | awk ' { print $1 } '`
if [ "${WHO}" = "userid" ]; then
exit
fi

--
To reply by email remove "_nospam"
.

Relevant Pages

  • Re: User Accounts with no shell access
    ... With the exception of 3 users, users do not need any shell ... > users that need no shell access there appears to be no need for a home ... procedures as well at the start, leaving the manual process in there so ... that it is clearly understood what the script does. ...
    (alt.os.linux.suse)
  • scponly, allowing sftp and denying ssh access
    ... shell access on a Solaris 10 system. ... The old trick used for restricting traditional FTP access only was to ... which prohibits user shell access but allows sftp and ftp access. ...
    (comp.security.ssh)
  • Re: Shell for tiny terminal
    ... > I'm the author of Anyterm, a javascript thing that gives you ... > shell access to your machine from a web browser. ... Sure you can have every command to pipe its output to ...
    (comp.unix.shell)
  • Re: shell ISP
    ... Don't know if you'll find one for $5/month that offers shell access. ... but those that offer shell usually charge around $20-30/month. ... DeeDee, don't press that button! ...
    (comp.unix.shell)
  • scponly in /etc/shells?
    ... How did manage Solaris ... the shell access? ... If I change the shell for a user to a different ... Pierre Bernhardt ...
    (comp.sys.sun.admin)