1

I have an Ubuntu server that is used for two primary purposes for my students:

  1. To hold on to files that students need to temporarily upload for my assessment (ie: I give them an input image, and they upload their homework MATLAB .m files and the output images, which is just my original image that they have run through their code).
  2. To serve as a proxy for students needing to access pages the school blocks (for whatever stupid reason). I've provided instructions for students using Ubuntu and Windows (via puTTY) to create an SSH tunnel and how to use FoxyProxy with Firefox to make use of the proxy.

All students are required to generate a public/private key pair, they give me the public key, which I add to the authorized_keys files for their account on my Ubuntu server. They are required to have the private key encrypted with a strong password, and not to share it with other students.

I currently have the single entry in authorized_keys for each account prefixed with no-pty, so the students are able to login to the server as a proxy, and use SFTP to upload files to the server. This is exactly the setup I need.

However, going forward, I may enable telnet and FTP on the server for a restricted number of accounts. If I want to prevent any service from having an interactive shell, I can just add /sbin/nologin or /dev/null to /etc/shells, and set the default shell for individual users to /etc/passwd, but this breaks the proxy and SFTP setup, but apparently allows FTP to work without allowing interactive logins.

Is there a way to just set "no interactive shells" in a single location, or should I abandon setting up telnet and FTP, and just stick to my SFTP setup? The only reason I'm considering FTP and telnet, which are much less secure than SFTP to my knowledge, is that some students are behing firewalls which prevent outgoing SSH connections.

Thank you.

3
  • 2
    Both telnet and ftp are useless today, with SSH and scp being much better alternatives. If you haven't a good reason to allow these protocols, don't bother! Both transmit passwords in clear text and should be illegal to use (except maybe for anonymous ftp).
    – Sven
    Sep 24, 2014 at 18:54
  • @SvW You make a very good point. Still, I'd like to see if this is viable, even if only for research purposes.
    – Cloud
    Sep 24, 2014 at 19:00
  • You could run sshd on the wrong port. Also the less used way of making an account sftp/tunnelling only is to set the persons' shell to sftp-server (/usr/libexec/openssh/sftp-server on rhel). For FTP you should try ProFTPd. You can set it to authenticate via pam, ignore the shell with "RequireValidShell off" and maybe require everyone to be in the /etc/ftpusers file with "UseFtpUsers on". Proftpd is really flexable. Sep 24, 2014 at 19:13

0

You must log in to answer this question.

Browse other questions tagged .