I have a solution and would welcome opinions, especially those that can pick holes in it.
I now have my three groups of users.
Users allowed SFTP only - set the account to have a shell of /etc/false
Users allowed SSH login and SFTP, normal user creation
Users allowed SSH login only, set them a secondary group of sshrestr
Then in /etc/ssh/sshd_config, code this towards the end:-
Then, in /usr/local/bin/ssh_restricted, pop in the following:-
The bit in green may need to be adjusted depending what you see in the syslog. That part is only to prevent the SFTP client getting a horrible error. This seems to prevent scp and remote commands with ssh, although I'm sure it could easily be adjusted to cater for them if we were to need them. This only prevents remote commands for users with the sshrestr group, so things such as backups, application updates etc. over ssh would be unaffected if run by any other user.
Does anyone have anything glaringly obvious, or even something subtle that is missed by this?
I forgot about 'service' accounts that should not be logged on to directly, even if the password is known, but I've hit upon another suggestion posted elsewhere that I should include.
If you have an account that should not login, but it runs services, you can just set the default shell to /dev/null, /bin/false etc. as you choose, however with use of su - userid -s /bin/ksh you can still switch user to it if you need to.
To start services (probably at boot or scripted) you would:-
It stops login, but allows function. Of course, there are bound to be things that will fall foul of this arrangement, but I thought it would be honorable to include it for anyone finding this thread, to have it available to consider.
As I do a ssh <nis_user>@server1 from server2, ssh prompts for certificates (as expected the first time), then it prompts for the users password, as soon as I enter the password, I get a Connection to server1 closed by remote host, and connection to server1 closed. and I disconnect back to the... (3 Replies)
hi
I have a few folders and a few files , for example
Directory A B C D E
Files 1 2 3 4 5
I want B directory and "2" File that does not sync
But other directories and file sync
What is the solution ?
Is there a way to sync time is under one minute?
os centos 6.8
thanks... (5 Replies)
HI Community.
I was trying to create ssh password less authentication for one user called night and it's not working for me.
These are the steps I followed:-
I have logged into the server and issued ssh-ketgen -t rsabash-3.2$ ssh-keygen -t rsa
Generating public/private rsa key pair.... (4 Replies)
Hi,
I am trying to restrict an ssh-user to execute unwanted commands using ssh from a remote host a. So for that I am using the forced command in the authorized_keys file that will allow the ssh-user to only execute a particular command.
If I did not set this, I am able to login via ssh and... (2 Replies)
Hi,
I want to suppress ssh login logs of a particular user to get logged in /var/adm/syslog/syslog.log
As am using a user to monitor a server over ssh in 5 miute interval..and that creating un-necessary logs in my syslog.log file .. Please help me if there any way I can suppress this logs only... (6 Replies)
I want to know if there is any way to set up a users home directory access with a restricted shell and allow them to SFTP to the directory. I want to allow the user to SSH into their home directory but no where else on the AIX server. I also want the user to be able to SFTP files to their home... (1 Reply)
I wrote this korn script and ran into a hole. I can use find to exclude all the hidden directories and to use my include file/exclude files for running a full backup
find / -depth -ipath '/home/testuser/.*' -prune -o -print| grep -f include.mydirs | grep -v -f exclude.mydirs
but when I... (8 Replies)
1)
ssh a@b
echo $USER it display the correct value as a (even though i have not defined it in .profile)
2)
remsh b -l a
echo $USER it does not display the value as a (variable is not set
any idea why $USER variable is not initialized when i login via remsh or rlogin but shows the... (10 Replies)
I want to login to server using ssh or telnet and execute one command then exit to the shell
Please let me know how to write script for this? (1 Reply)
HI,
We are facing a problem while trying to login using ssh.
The user is able to login using telnet.
We are able to login as another user using ssh and then su to that user which is successfull.
What should i be checking for the user to be able to login directly using ssh.
Thanks in... (2 Replies)