High Tech Sorcery » security http://hightechsorcery.com technology indistinguishable from magic Tue, 01 May 2012 08:48:12 +0000 en hourly 1 http://wordpress.org/?v=3.3.2 Setting up a user with only scp and sftp access http://hightechsorcery.com/2010/01/setting-up-a-user-with-only-scp-and-sftp-access/ http://hightechsorcery.com/2010/01/setting-up-a-user-with-only-scp-and-sftp-access/#comments Wed, 20 Jan 2010 01:37:23 +0000 specialj http://hightechsorcery.com/?p=7 In the olden days one had to use packages such as scponly and rssh in order to restrict a user account to just being able to use scp and sftp.  Now that functionality is built into OpenSSH.  A client wanted me to setup such an account for 1 user on a system.  I modified sshd_config like this:

Match user username
  ChrootDirectory /home/%u
  ForceCommand internal-sftp
  X11Forwarding no
  AllowTcpForwarding no

Note that this only works in Ubuntu 8.10 and later and Debian 5.0 and later.  Also, be aware that the home directry has to be owned by root and not writable by the user for security reason.  So a directory inside the home directory will need to be created for the user to upload any files.

References:

  1. OpenSSH SFTP chroot() with ChrootDirectory
  2. Chroot users with OpenSSH: An easier way to confine users to their home directories

Chroot users with OpenSSH: An easier way to confine users to their home directories

]]> http://hightechsorcery.com/2010/01/setting-up-a-user-with-only-scp-and-sftp-access/feed/ 0