Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

there are many solutions described to get ur SSH-connection forced to only run SFTP by modifying the sshd_config by adding a new group match and give that new group a Forcecommand internal-sftp

Well that works great but i would love to have a little more feature.

My servers automatically ban IP's which try to connect often in a short time. So when you use any SFTP-Client, which opens multiple connections to work faster it can get banned instandly by the server for a long time.

The servers have a script to whitelist users by administrator. I've modified this script to whitelist the user, which runs the script.

All i need to do is now get the server to execute that script, when somebody logins. On SSH it's no problem, just put it in .bashrc or something like, but the Forcecommand don't runs these scripts on login.

Is there any way to run such a shellscript before or at the same time as the Forcecommand get fired?

share|improve this question
If you're running something like fail2ban, then you should be banning IPs which fail to login, not those which succeed. – Michael Hampton Oct 20 '12 at 12:17
im using netfilter, which just ban IPs based on iptables. – Chris Oct 20 '12 at 14:03

if the problem you are having is people trying to brute force their way in, try changing the port that your sftp server is on. People generally only spam port 22.

share|improve this answer
i dont wanted to change my security methods that way - IP-filter is a must have for me. – Chris Oct 22 '12 at 20:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.