LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   scp restriction to particular folder (https://www.linuxquestions.org/questions/linux-newbie-8/scp-restriction-to-particular-folder-833998/)

malickhat 09-23-2010 07:42 AM
scp restriction to particular folder
 
This is my problem,i need to give some user from other machine to my machine where they can get my data,but i want to give them only one dir where they can download file and i'm trying to use scp to this solution
Code:
[root@malick ~]# ssh -V
OpenSSH_3.9p1, OpenSSL 0.9.7a Feb 19 2003

divyashree 09-23-2010 08:17 AM
Quote:
Originally Posted by malickhat (Post 4106663)
This is my problem,i need to give some user from other machine to my machine where they can get my data,but i want to give them only one dir where they can download file and i'm trying to use scp to this solution
Code:
[root@malick ~]# ssh -V
OpenSSH_3.9p1, OpenSSL 0.9.7a Feb 19 2003
SCP uses SSH,and by SSH an user have full control over a terminal as a local user,so have you given him the root level access or any user level access ?

If you are giving root level access to other by ssh, then it's equivalent to root level access in local system.

So give the remote user an userlevel access permission. Then you can apply restriction on different folder by restricting permission.

meandsushil 09-23-2010 08:27 AM
How to block others from ssh to my system as root?

divyashree 09-23-2010 08:45 AM
Quote:
Originally Posted by meandsushil (Post 4106718)
How to block others from ssh to my system as root?
Simple answer, good password , which will be difficult for others to ssh as root.

Just create an user in your system in the name who want to access,

or ask to access ssh as a user

Code:
#ssh user@<IP of your system>
or use the same format while doing scp.

malickhat 09-23-2010 08:52 AM
Quote:
Originally Posted by divyashree (Post 4106705)
SCP uses SSH,and by SSH an user have full control over a terminal as a local user,so have you given him the root level access or any user level access ?
i've created a particular user for him not a roor level access

Code:
So give the remote user an userlevel access permission. Then you can apply restriction on different folder by restricting permission.
i've completely blocked from logging in to my system by etc host and deny.but by having a non root access .he can't download other's home dir or so,but he can download /etc easily,
so my point is i want to give him only one folder other than that nothing

divyashree 09-23-2010 02:15 PM
all the /etc files are owned by root. He can get things but he neither can edit any of the file or put anything there in /etc.

Do you keep data in /etc ? It's only for system configuration file.

jschiwal 09-23-2010 02:23 PM
Maybe this howto on chroot jailing ssh users would help.
http://www.howtoforge.com/chrooted_ssh_howto_debian

malickhat 09-23-2010 11:19 PM
Quote:
Originally Posted by divyashree (Post 4106987)
all the /etc files are owned by root. He can get things but he neither can edit any of the file or put anything there in /etc.
You right he can't put any thing,but he can download all my service related configuration files right ,i really don't want to do that

Quote:
Do you keep data in /etc ? It's only for system configuration file.
i don't keep the data inside /etc , but i feel my sshd config file is also my data

malickhat 09-23-2010 11:22 PM
Quote:
Originally Posted by jschiwal (Post 4106995)
Maybe this howto on chroot jailing ssh users would help.
http://www.howtoforge.com/chrooted_ssh_howto_debian
Really helped,but why can't their be any inbuilt configuration setup in ssh for this solution ,is that a bug or what

jschiwal 09-26-2010 05:25 PM
Because you are using the shell or scp, certain files must be available to support the session. The jail needs certain directories copied for the users commands to work.

See the manpage for sshd_config. The last paragraph in the ChrootDirectory section explains that you can do things easier if you only allow sftp, but not ssh or scp.

Code:
In the special case when only sftp is used, not ssh nor scp, it is possible to use ChrootDirectory %h or ChrootDirectory /some/path/%u. The file system
            containing this directory must be mounted with options nodev and either nosuid or noexec. The owner of the directory should be the user. The ownership
            of the other components of the path must fulfill the usual conditions. No aditional files are required to be present in the directory.
If you only want users to simply save or download files, you might consider using sftp instead of scp.


All times are GMT -5. The time now is 05:19 PM.