scp restriction to particular folder

malickhat · 09-23-2010, 07:42 AM

This is my problem,i need to give some user from other machine to my machine where they can get my data,but i want to give them only one dir where they can download file and i'm trying to use scp to this solution

Code:

[root@malick ~]# ssh -V
OpenSSH_3.9p1, OpenSSL 0.9.7a Feb 19 2003

divyashree · 09-23-2010, 08:17 AM

Quote:

Originally Posted by malickhat

This is my problem,i need to give some user from other machine to my machine where they can get my data,but i want to give them only one dir where they can download file and i'm trying to use scp to this solution

Code:

[root@malick ~]# ssh -V
OpenSSH_3.9p1, OpenSSL 0.9.7a Feb 19 2003

SCP uses SSH,and by SSH an user have full control over a terminal as a local user,so have you given him the root level access or any user level access ?

If you are giving root level access to other by ssh, then it's equivalent to root level access in local system.

So give the remote user an userlevel access permission. Then you can apply restriction on different folder by restricting permission.

meandsushil · 09-23-2010, 08:27 AM

How to block others from ssh to my system as root?

divyashree · 09-23-2010, 08:45 AM

Quote:

Originally Posted by meandsushil

How to block others from ssh to my system as root?

Simple answer, good password , which will be difficult for others to ssh as root.

Just create an user in your system in the name who want to access,

or ask to access ssh as a user

Code:

#ssh user@<IP of your system>

or use the same format while doing scp.

malickhat · 09-23-2010, 08:52 AM

Quote:

Originally Posted by divyashree

SCP uses SSH,and by SSH an user have full control over a terminal as a local user,so have you given him the root level access or any user level access ?

i've created a particular user for him not a roor level access

Code:

So give the remote user an userlevel access permission. Then you can apply restriction on different folder by restricting permission.

i've completely blocked from logging in to my system by etc host and deny.but by having a non root access .he can't download other's home dir or so,but he can download /etc easily,
so my point is i want to give him only one folder other than that nothing

divyashree · 09-23-2010, 02:15 PM

all the /etc files are owned by root. He can get things but he neither can edit any of the file or put anything there in /etc.

Do you keep data in /etc ? It's only for system configuration file.

jschiwal · 09-23-2010, 02:23 PM

Maybe this howto on chroot jailing ssh users would help.
http://www.howtoforge.com/chrooted_ssh_howto_debian

malickhat · 09-23-2010, 11:19 PM

Quote:

Originally Posted by divyashree

all the /etc files are owned by root. He can get things but he neither can edit any of the file or put anything there in /etc.

You right he can't put any thing,but he can download all my service related configuration files right ,i really don't want to do that

Quote:

Do you keep data in /etc ? It's only for system configuration file.

i don't keep the data inside /etc , but i feel my sshd config file is also my data

malickhat · 09-23-2010, 11:22 PM

Quote:

Originally Posted by jschiwal

Maybe this howto on chroot jailing ssh users would help.
http://www.howtoforge.com/chrooted_ssh_howto_debian

Really helped,but why can't their be any inbuilt configuration setup in ssh for this solution ,is that a bug or what

jschiwal · 09-26-2010, 05:25 PM

Because you are using the shell or scp, certain files must be available to support the session. The jail needs certain directories copied for the users commands to work.

See the manpage for sshd_config. The last paragraph in the ChrootDirectory section explains that you can do things easier if you only allow sftp, but not ssh or scp.

Code:

In the special case when only sftp is used, not ssh nor scp, it is possible to use ChrootDirectory %h or ChrootDirectory /some/path/%u. The file system
             containing this directory must be mounted with options nodev and either nosuid or noexec. The owner of the directory should be the user. The ownership
             of the other components of the path must fulfill the usual conditions. No aditional files are required to be present in the directory.

If you only want users to simply save or download files, you might consider using sftp instead of scp.