1

We have a web app that allows our users to set up vendor SFTP accounts. We want our users to be able to manage the vendor accounts that can access their server in a reversible fashion, ie, without changing the password.

Would handing it via group membership be the best way to do it?

Users are currently chrooted and jailed to their home directory on login.

The machine is running Debian Squeeze (6.0.4) and OpenSSH_5.5p1

6
  • I don't understand what you want to achieve? if you don't want to change passwords what is you want to allow your users to enable / disable / change? Aug 19, 2013 at 23:02
  • Am I understanding you correctly that your users should be able to temporarily disable SFTP access for a certain vendor, without deleting the vendor's password (and thus having to create a new one when re-activating the account)?
    – n.st
    Aug 19, 2013 at 23:11
  • @n.st - yes, exactly that.
    – yubus
    Aug 19, 2013 at 23:12
  • @AngryWombat - the web app part may not be pertinent to the question. I'm the backend dev dealing with the implementation, so it made sense for me to add that.
    – yubus
    Aug 19, 2013 at 23:15
  • @EricB - Then yes, creating either a whitelist or blacklist group for the enabled/disabled vendor accounts is likely a good approach.
    – n.st
    Aug 19, 2013 at 23:16

1 Answer 1

0

My answers are is based on the premise that you're using system user accounts to manage sftp users.

  1. passwd --lock johndoe and passwd --unlock johndoe (won't take into account SSH keys, but the manpage passwd(1) offers a workaround
  2. remove the user's system account and save the password hash from /etc/master.passwd, then recreate the user once it's enabled
  3. modify the user's login shell to point to either /bin/noshell or an executable script that bounces them out with an error immediately or informative message
  4. create a group "whitelist" and a group "blacklist" - add sftp users to either group. modify group permissions accordingly to allow one to execuete /usr/libexec/sftp-server or whatever accordingly and one not
1
  • Thank you for suggestion #1. It is exactly what I was looking for.
    – yubus
    Aug 20, 2013 at 23:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .