Sponsored Content
Operating Systems Linux Red Hat SFTP user include/exclude without preventing SSH login Post 302794577 by rbatte1 on Tuesday 16th of April 2013 10:27:46 AM
Old 04-16-2013
I have a solution and would welcome opinions, especially those that can pick holes in it.
I now have my three groups of users.
  1. Users allowed SFTP only - set the account to have a shell of /etc/false
  2. Users allowed SSH login and SFTP, normal user creation
  3. Users allowed SSH login only, set them a secondary group of sshrestr

Then in /etc/ssh/sshd_config, code this towards the end:-
Code:
Match Group sshrestr
     ForceCommand     /usr/local/bin/ssh_restricted

Then, in /usr/local/bin/ssh_restricted, pop in the following:-
Code:
#!/bin/ksh
if [ -z "$SSH_ORIGINAL_COMMAND" ]
then
   exec `grep "^\`id -un\`:" /etc/passwd|cut -f7 -d":"`
else
   logger "Access denied attempting \"$SSH_ORIGINAL_COMMAND\""
   if [ "$SSH_ORIGINAL_COMMAND" != \
        "/usr/sbin/sftp-server -m /etc/ssh/sshd_config" ]
   then
      print "Access denied"
   fi
   exit
fi

The bit in green may need to be adjusted depending what you see in the syslog. That part is only to prevent the SFTP client getting a horrible error. This seems to prevent scp and remote commands with ssh, although I'm sure it could easily be adjusted to cater for them if we were to need them. This only prevents remote commands for users with the sshrestr group, so things such as backups, application updates etc. over ssh would be unaffected if run by any other user.

Does anyone have anything glaringly obvious, or even something subtle that is missed by this?


Thanks, in advance,
Robin
Liverpool/Blackburn
UK
 

10 More Discussions You Might Find Interesting

1. HP-UX

User not able to login directly using ssh

HI, We are facing a problem while trying to login using ssh. The user is able to login using telnet. We are able to login as another user using ssh and then su to that user which is successfull. What should i be checking for the user to be able to login directly using ssh. Thanks in... (2 Replies)
Discussion started by: sag71155
2 Replies

2. Shell Programming and Scripting

SSH login with user name and script.

I want to login to server using ssh or telnet and execute one command then exit to the shell Please let me know how to write script for this? (1 Reply)
Discussion started by: svenkatareddy
1 Replies

3. UNIX for Dummies Questions & Answers

$USER is not set in remsh but works fine via ssh login

1) ssh a@b echo $USER it display the correct value as a (even though i have not defined it in .profile) 2) remsh b -l a echo $USER it does not display the value as a (variable is not set any idea why $USER variable is not initialized when i login via remsh or rlogin but shows the... (10 Replies)
Discussion started by: reldb
10 Replies

4. Shell Programming and Scripting

Using Grep Include/Exclude Files

I wrote this korn script and ran into a hole. I can use find to exclude all the hidden directories and to use my include file/exclude files for running a full backup find / -depth -ipath '/home/testuser/.*' -prune -o -print| grep -f include.mydirs | grep -v -f exclude.mydirs but when I... (8 Replies)
Discussion started by: metallica1973
8 Replies

5. AIX

restricting sftp and ssh for a user

I want to know if there is any way to set up a users home directory access with a restricted shell and allow them to SFTP to the directory. I want to allow the user to SSH into their home directory but no where else on the AIX server. I also want the user to be able to SFTP files to their home... (1 Reply)
Discussion started by: daveisme
1 Replies

6. HP-UX

Suppress SSH login logs of a user

Hi, I want to suppress ssh login logs of a particular user to get logged in /var/adm/syslog/syslog.log As am using a user to monitor a server over ssh in 5 miute interval..and that creating un-necessary logs in my syslog.log file .. Please help me if there any way I can suppress this logs only... (6 Replies)
Discussion started by: Shirishlnx
6 Replies

7. Shell Programming and Scripting

How to restrict ssh by forced commands but sftp login should be enabled?

Hi, I am trying to restrict an ssh-user to execute unwanted commands using ssh from a remote host a. So for that I am using the forced command in the authorized_keys file that will allow the ssh-user to only execute a particular command. If I did not set this, I am able to login via ssh and... (2 Replies)
Discussion started by: Anil George
2 Replies

8. Solaris

How can i setup ssh password-less login for particular user?

HI Community. I was trying to create ssh password less authentication for one user called night and it's not working for me. These are the steps I followed:- I have logged into the server and issued ssh-ketgen -t rsabash-3.2$ ssh-keygen -t rsa Generating public/private rsa key pair.... (4 Replies)
Discussion started by: bentech4u
4 Replies

9. Shell Programming and Scripting

Rsync exclude & include?

hi I have a few folders and a few files , for example Directory A B C D E Files 1 2 3 4 5 I want B directory and "2" File that does not sync But other directories and file sync What is the solution ? Is there a way to sync time is under one minute? os centos 6.8 thanks... (5 Replies)
Discussion started by: mnnn
5 Replies

10. AIX

Ssh not allowing NIS user to login

As I do a ssh <nis_user>@server1 from server2, ssh prompts for certificates (as expected the first time), then it prompts for the users password, as soon as I enter the password, I get a Connection to server1 closed by remote host, and connection to server1 closed. and I disconnect back to the... (3 Replies)
Discussion started by: mrmurdock
3 Replies
Net::SFTP::Foreign::Compat(3pm) 			User Contributed Perl Documentation			   Net::SFTP::Foreign::Compat(3pm)

NAME
Net::SFTP::Foreign::Compat - Adaptor for Net::SFTP compatibility SYNOPSIS
use Net::SFTP::Foreign::Compat; my $sftp = Net::SFTP::Foreign::Compat->new($host); $sftp->get("foo", "bar"); $sftp->put("bar", "baz"); use Net::SFTP::Foreign::Compat ':supplant'; my $sftp = Net::SFTP->new($host); DESCRIPTION
This package is a wrapper around Net::SFTP::Foreign that provides an API (mostly) compatible with that of Net::SFTP. Methods on this package are identical to those in Net::SFTP except that Net::SFTP::Foreign::Attributes::Compat objects have to be used instead of Net::SFTP::Attributes. If the ":supplant" tag is used, this module installs also wrappers on the "Net::SFTP" and Net::SFTP::Attributes packages so no other parts of the program have to modified in order to move from Net::SFTP to Net::SFTP::Foreign. Setting defaults The hash %Net::SFTP::Foreign::DEFAULTS can be used to set default values for Net::SFTP::Foreign methods called under the hood and otherwise not accesible through the Net::SFTP API. The entries currently supported are: new => @opts extra options passed to Net::SFTP::Foreign constructor. get => @opts extra options passed to Net::SFTP::Foreign::get method. put => @opts extra options passed to Net::SFTP::Foreign::put method. ls => @opts extra options passed to Net::SFTP::Foreign::ls method. COPYRIGHT
Copyright (c) 2006-2008, 2011 Salvador Fandin~o All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself. perl v5.14.2 2012-05-04 Net::SFTP::Foreign::Compat(3pm)
All times are GMT -4. The time now is 06:53 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy