LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 10-06-2013, 03:57 PM   #1
barry1946
LQ Newbie
 
Registered: Dec 2011
Posts: 4

Rep: Reputation: Disabled
creating limited sftp access


I need to create a limited sftp user for a 3rd party company which needs to collect some data from a specific directory on a OpenSuse server.
these data are generating contentiously so they need constant connection but I need to limit their accessto only be able to transfer those data and them absolutely nothing.
please help with the approach.
 
Old 10-06-2013, 06:12 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Either an account with the sshd_config ChrootDirectory directive or a shell like 'rssh' (can use chroot too). BTW if you don't like to provide them access to your system there's other ways ranging from netcat, a simple Xinetd service (behind stunnel?) to streaming data to them using Syslog-NG, Rsyslog or an SSH "listener" on their system...
 
Old 10-07-2013, 12:19 AM   #3
Jerry Mcguire
Member
 
Registered: Jul 2009
Location: Hong Kong SAR
Distribution: RedHat, Fedora
Posts: 201

Rep: Reputation: 31
Talking

I'm fairly new to this too. Some of the users on our system have /usr/libexec/openssh/sftp-server as the login shell. These users can only login using sftp, not even scp. You might want to also consider chroot as suggested above. Cheers.
 
Old 10-07-2013, 07:21 AM   #4
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 7,328
Blog Entries: 3

Rep: Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726
You can put all the users you want to restrict to SFTP into one group and then configure /etc/ssh/sshd_config to limit them to SFTP only, chrooted or not.

Code:
Subsystem sftp internal-sftp

Match Group sftp-only
        AllowTCPForwarding no
        X11Forwarding no
        ForceCommand internal-sftp
That will allow them SFTP and nothing else. If you need to limit them to just a particular set of directories that is easily done with ChrootDirectory, already mentioned in another post.

Code:
Subsystem sftp internal-sftp

Match Group sftp-only
        AllowTCPForwarding no
        X11Forwarding no
        ChrootDirectory /var/data
        ForceCommand internal-sftp
With ChrootDirectory there is one condition that must be met: The directory and all directories above it, on up to root, must be root-owned and not writable by any other user or group. That makes chrooting to home directories harder but still possible.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Ubuntu server- creating a limited apache user account with domain name? ashamanmiller Linux - Server 1 07-19-2012 08:49 PM
sftp user with limited ssh permissions to autologin using publickey blazingrock4u Linux - Security 1 10-18-2010 11:52 AM
Need help creating VERY LIMITED user accounts damgar Linux - Newbie 8 10-25-2009 12:57 AM
Creating user with SFTP permission to only one directory swapnesh_sharma Linux - General 2 08-27-2009 08:10 AM
Question on creating SFTP user in RHEL 4.0 a2vr6 Linux - Security 3 07-23-2008 12:07 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 07:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration