SFTP user include/exclude without preventing SSH login

 
Thread Tools Search this Thread
Operating Systems Linux Red Hat SFTP user include/exclude without preventing SSH login
# 1  
Old 03-21-2013
SFTP user include/exclude without preventing SSH login

I have been asked to see if we can restrict SFTP access to authorised users only. There will be business users who will log on with SSH, but they are locked into a menu. They will have write access to the production data to do their job, but we don't want them to have access to read/write the files with SFTP or anything else for that matter.

For plain FTP, we would use the /etc/ftpusers file and re-create it each night with all users in /etc/passwd except those in the allowed list. Not clever, but it worked.


We're running RHEL / Centos 6.3 and the server is running vsftp is installed for plain FTP along with openssh-server-5.3p1-81.el6_3.x86_64 The sshd_config file defines sftp as starting up /usr/libexec/openssh/sftp-server


Any suggestions? Badly, the users home directory is a common area with the application & data below it, so I can't just enforce the chroot jail. User SSH login is by userid/password rather than certificate. Not sure if that helps or hinders.


Thanks, in advance,
Robin
# 2  
Old 03-21-2013
Maybe setting up sshd_config with a Match block and a ForceCommand for the users you don't want to have SFTP access would prevent spawning the SFTP subsystem?

I'd also test it against SCP attempts.

Worst case, you could try running two SSHD daemons, on different interfaces. Set up one for your clients to ONLY run what you want - set the SFTP subsystem to /dev/null, for example. Set up the other SSHD daemon for everyone else. Then use the Match blocks in the two sshd_config files to control access, probably based on group membership.
This User Gave Thanks to achenle For This Post:
# 3  
Old 03-21-2013
Thanks for the suggestion achenle.

Are you suggesting effectively switching SFTP to another port? Who cares if SSH is used for login on that port too, we control that so our SFTP/FTP only accounts have shell /dev/null. That might prove fun for those wishing to use SFTP though. If I set up the client side ssh_config to use the changed port, then I guess that everyone will get it by default. It's a puzzler.


I can't get a match block in the SFTP bit of sshd_config file. It is not supported.


Robin
Liverpool/Blackburn
UK
# 4  
Old 03-21-2013
As mentioned before, spawning a second instance of SSH daemon running on a different port would be the easiest approach.

You may also want to use something like rssh (rssh - restricted shell for scp/sftp) as the default shell and restrict all users to SFTP/SSH *ONLY*. You can even use rssh in both daemons, each one using its own copy of rssh.conf.

Keep in mind that rssh is not an official package and there are no pre-compiled packages available so you'll need to compile it yourself.

One benefit of this is that you won't need to mess with sshd_config and potentially break something else.

rssh is also compatible with older versions of SSH so it should work just fine with "ancient" versions.
# 5  
Old 03-22-2013
It still doesn't let me explicitly allow/prevent people SFTP access though. They would merely have to re-direct to the alternate port, and that sort of info will need to be published to those people/servers that we do want to have SFTP access.

For a server to have access, we'd have to update the client side ssh_config I suppose, but that will mean any user of that server could then open the connection to the alternate SSH port that we want to protect by default.


Am I missing something? By the way, I'm hoping that any SSH connection with a command will execute /etc/profile first. Is that the case? If not, then I'm lost, because a user could just:-
Code:
ssh user1@server1 "cat secure_file" > my_copy
vi my_copy
cat my_copy | ssh user1@server1 "dd of=secure_file"

Am I just depressing myself unnecessarily?


Robin
# 6  
Old 03-22-2013
Possibility:
OpenSSH has chroot functionality in current versions. On the type of subsystem. Basically you just need to add lines like below to your
Code:
/etc/ssh/sshd_config file.

Code:
Subsystem sftp internal-sftp

Match group sftpusers
     ChrootDirectory /var/www/someplace/safe
     X11Forwarding no
     AllowTcpForwarding no
     ForceCommand internal-sftp

Next create a group sftpusers with command
Code:
groupadd sftpusers

The last step is then to create a user belonging to group sftpusers:

Code:
useradd -g sftpusers -d /var/www/xy/backup/files username

restart your ssh service:
Code:
/etc/init.d/sshd restart

This only affects sftp access only. And users in the sftpusers group only.

/var/www/someplace/safe is completely your decision. All this is on the assumption that I understood what you want. What you presented seems an almost unworkable melange of stuff as is. So feel free to ignore this.
# 7  
Old 03-23-2013
Jim,

So close! I've turned your suggestion around and now have:-
Code:
:
:
:
# override default of no subsystems
Subsystem       sftp    /bin/false

# Example of overriding settings on a per-user basis
Match Group sftpusers
        X11Forwarding no
        AllowTcpForwarding no
        ForceCommand /usr/libexec/openssh/sftp-server

.... which blocks anyone who doesn't have group sftpusers assigned (secondary group allowed) but unfortunately it doesn't let them SSH login.



Bother.

I will get digging some more on the OpenBSD site, as I think that they are the source for whet we have.



Robin
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. AIX

Ssh not allowing NIS user to login

As I do a ssh <nis_user>@server1 from server2, ssh prompts for certificates (as expected the first time), then it prompts for the users password, as soon as I enter the password, I get a Connection to server1 closed by remote host, and connection to server1 closed. and I disconnect back to the... (3 Replies)
Discussion started by: mrmurdock
3 Replies

2. Shell Programming and Scripting

Rsync exclude & include?

hi I have a few folders and a few files , for example Directory A B C D E Files 1 2 3 4 5 I want B directory and "2" File that does not sync But other directories and file sync What is the solution ? Is there a way to sync time is under one minute? os centos 6.8 thanks... (5 Replies)
Discussion started by: mnnn
5 Replies

3. Solaris

How can i setup ssh password-less login for particular user?

HI Community. I was trying to create ssh password less authentication for one user called night and it's not working for me. These are the steps I followed:- I have logged into the server and issued ssh-ketgen -t rsabash-3.2$ ssh-keygen -t rsa Generating public/private rsa key pair.... (4 Replies)
Discussion started by: bentech4u
4 Replies

4. Shell Programming and Scripting

How to restrict ssh by forced commands but sftp login should be enabled?

Hi, I am trying to restrict an ssh-user to execute unwanted commands using ssh from a remote host a. So for that I am using the forced command in the authorized_keys file that will allow the ssh-user to only execute a particular command. If I did not set this, I am able to login via ssh and... (2 Replies)
Discussion started by: Anil George
2 Replies

5. HP-UX

Suppress SSH login logs of a user

Hi, I want to suppress ssh login logs of a particular user to get logged in /var/adm/syslog/syslog.log As am using a user to monitor a server over ssh in 5 miute interval..and that creating un-necessary logs in my syslog.log file .. Please help me if there any way I can suppress this logs only... (6 Replies)
Discussion started by: Shirishlnx
6 Replies

6. AIX

restricting sftp and ssh for a user

I want to know if there is any way to set up a users home directory access with a restricted shell and allow them to SFTP to the directory. I want to allow the user to SSH into their home directory but no where else on the AIX server. I also want the user to be able to SFTP files to their home... (1 Reply)
Discussion started by: daveisme
1 Replies

7. Shell Programming and Scripting

Using Grep Include/Exclude Files

I wrote this korn script and ran into a hole. I can use find to exclude all the hidden directories and to use my include file/exclude files for running a full backup find / -depth -ipath '/home/testuser/.*' -prune -o -print| grep -f include.mydirs | grep -v -f exclude.mydirs but when I... (8 Replies)
Discussion started by: metallica1973
8 Replies

8. UNIX for Dummies Questions & Answers

$USER is not set in remsh but works fine via ssh login

1) ssh a@b echo $USER it display the correct value as a (even though i have not defined it in .profile) 2) remsh b -l a echo $USER it does not display the value as a (variable is not set any idea why $USER variable is not initialized when i login via remsh or rlogin but shows the... (10 Replies)
Discussion started by: reldb
10 Replies

9. Shell Programming and Scripting

SSH login with user name and script.

I want to login to server using ssh or telnet and execute one command then exit to the shell Please let me know how to write script for this? (1 Reply)
Discussion started by: svenkatareddy
1 Replies

10. HP-UX

User not able to login directly using ssh

HI, We are facing a problem while trying to login using ssh. The user is able to login using telnet. We are able to login as another user using ssh and then su to that user which is successfull. What should i be checking for the user to be able to login directly using ssh. Thanks in... (2 Replies)
Discussion started by: sag71155
2 Replies
Login or Register to Ask a Question