Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have some generic Ids for working on the Linux boxes. Recently we decided that the generic account will be locked out for logins and people will get individual IDs (which is always the best choice, so far auditing is concerned). The issue is, I am not able to figure out will this also ensure that scp connections which use this generic ID - will start to fail? Even though a trust relationship exist between source and destination servers, authentication and authorization is needed (As far as I think).

Can someone help me in figuring this out as to will scp connections be affected? And if they will, what alternatives I have to ensure that even though no one can login through that generic ID on the box, scp connections can be made.

Thanks, Ankur

share|improve this question

migrated from stackoverflow.com Nov 3 '10 at 3:34

This question came from our site for professional and enthusiast programmers.

1  
Just try it yourself. Setup test environment similar to your one (if needed) and try to SCP in it. –  Lavir the Whiolet Nov 2 '10 at 20:18

2 Answers 2

I faced a situation where I wanted to give a client scp access to my linux box, but nothing else. To accomplish when I created the user account I specified it's shell environment to be rssh, or resticted shell. Then in the conf file (/etc/rssh.conf, can't remember) I turned off all connections except scp and/or sftp. To turn off a connection type, simply comment the line out with a "#".

Google for rssh and you can find the correct package you need.

Create restricted account:

 $ useradd -m -d /home/username -s /usr/bin/rssh username
share|improve this answer
1  
Another option is scponly. It can restrict to just sftp or allow scp and a few other applications. It also supports chrooting, etc. Disclosure: I'm one of the maintainers. –  Kaleb Pederson Nov 2 '10 at 21:06

Just to be (a bit) different: lshell is a great way to annoy... I mean, restrict your users.

With it you can restrict some users or groups to scp/sftp only, and/or allow them to run only a handful of shell commands. If they have the nerve to run anything else, they get warned about that and then kicked out after entering not listed commands for more than X times. :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.