428 reputation
211
bio website
location
age
visits member for 2 years
seen 30 mins ago

Dec
23
awarded  Good Answer
Dec
21
comment Enable SSH shell access but disable SFTP access
It seems that at least for ForceCommand and forced passwordless login with command= in authorized_keys, while it has been bypassed before, that's due to a bug in the server: it is intended to be secure against a malicious user, and a user bypassing it counts as a serious vulnerability in the SSH server (and is thus a priority fix). As you point out, .profile is bypassable by design: as it's not considered a security feature, a user bypassing it is perfectly OK from the shell developer's point of view.
Dec
21
revised Enable SSH shell access but disable SFTP access
added 277 characters in body
Dec
21
comment Enable SSH shell access but disable SFTP access
@AleksiTorhamo Ah. I suspected you could bypass it, but wasn't certain how (I generally suspect that things not intended for security are bypassable). Thanks for the details on how!
Dec
20
awarded  Nice Answer
Dec
20
awarded  Yearling
Dec
20
answered Enable SSH shell access but disable SFTP access
Dec
20
comment Enable SSH shell access but disable SFTP access
@R.. Or, for that matter, they could tar and base64-encode another user's data directory, send it to pastebin with wget or curl, copy it to their own computer, and base64-decode it and untar it to get the full data directory. Even if there's nothing ssh-related they can do, they can still download data directories.
May
15
comment How does CTRL-ALT-DEL to log in make Windows more secure?
@Arjan My school system's XP boxes had that setup - all users, even the normally supposed-to-be-very locked-down students, had System32 write access. ...yeah. There were several students every year with the local administrator password for all the computers at the school. And with PsTools.
Mar
18
awarded  Popular Question
Feb
3
awarded  Tumbleweed
Jan
23
accepted Connection closed [preauth]
Jan
18
answered Connection closed [preauth]
Jan
18
asked Connection closed [preauth]
Jan
17
awarded  Informed
Jan
6
awarded  Supporter
Jan
4
comment Thin clients over WAN - Capacity planning
This seems like it belongs on Server Fault.
Jan
4
suggested rejected edit on Is this a denial of service attack?
Jan
1
awarded  Citizen Patrol
Jan
1
awarded  Teacher