1

Requirement:

Allow SSH but disallow SFTP to a particular user group. Once disallowed, if the user group tries to access SFTP, it should not be allowed and all connections should be closed and the user should get the prompt back.

Current situation:

I'm able to disallow a particular user group using a Match block and Forcecommand. But not able to get the prompt back once login fails.

Example:

abcd> sftp [email protected] [Does not allow but it remains in a hang state]

Need to press Ctlr C to get back the prompt (abcd>)

Expectation:

abcd> sftp [email protected] [Fails next line prompt should be back]
abcd>

I want to know if it is possible, if yes share your inputs.

6
  • 7
    Why do you want to do this in the first place? If users have shell access they can copy/move file as desired. What's the benefit of disallowing sftp then?
    – Marco
    Sep 21, 2013 at 9:10
  • The concerned user group should not have access. That is requirement for security purpose.
    – MaxintowN
    Sep 21, 2013 at 9:18
  • 2
    "Security purpose" says nothing. What is the real reason? After all, if these users cannot be allowed to transfer files, then they should not be allowed to access the system at all. Sep 21, 2013 at 11:48
  • 2
    note that copying a file a user has the permission to read on a remote system is a no-brainer as long as the user has ssh access at all - no matter if SFTP- or SCP-related commands are available: # ssh [email protected] 'cat /etc/passwd' > ~/passwd.remote.host
    – the-wabbit
    Sep 21, 2013 at 12:00
  • 1
    I can only tell you how to allow sftp but disallow a shell. The other way around does not really make sense to me.
    – Nils
    Sep 21, 2013 at 21:30

3 Answers 3

2

Disregarding the question title and instead focusing on the question in the comments:

The concerned user group should not have access. That is requirement for security purpose.

there is a fairly simple solution. Assuming OpenSSH (other software should have similar configuration options), edit /etc/ssh/sshd_config and add or augment the directives:

  • AllowUser
  • AllowGroup
  • DenyUser
  • DenyGroup

For example, to deny all access for users belonging to the group "no-ssh", you'd add:

DenyGroup no-ssh

The reverse, allow access for users belonging to the group "ssh", can be done similarly:

AllowGroup ssh

See the discussion in the man page about the relative priority of these directives and what patterns are supported.

The authentication rejection will be done on the protocol level so you should get an error message like "access denied" and be returned to where you were if you try.

Just be careful to not lock yourself out.

0

I see two possibilities - none of them tested:

  1. change your lokal sftp-binary to a special group, make it executable by that group, not others. Only users allowed for sftp are members of that group.
  2. change sftp to "internal" and activate a non-working chroot-environment for the group that is to be blocked.
-2

if you want to disallow SFTP but allow SSH, just comment the follow line:

 Subsystem sftp /usr/lib/openssh/sftp-server

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .