2

How can I disable some commands in SFTP for my clients, like ln & symlink?

I've checked man sftp, but didn't find what I'm searching for.

Improve this question
2
  • This doesn't make much sense. Why do you want to do this?
    – Michael Hampton
    Mar 4, 2017 at 3:32
  • As Michael Hampton said, this doesn't make sense. The only thing I can think to do is disallow access to those commands with Linux ACLs from the users that log onto your server via SFTP and/or, depending if you're running SFTP in a chroot jail, the specific user that is running SFTP.
    – cerberus
    Mar 4, 2017 at 4:15

2 Answers 2

Reset to default
4

You did not specify, what SFTP server are you using. I'm assuming the OpenSSH.

The sftp-server (and the compatible internal-sftp) has the -P and -p switches to black/white list certain SFTP requests.

You can use them to disallow the symlink requests:

Subsystem sftp internal-sftp -P symlink
Improve this answer
4
  • I've tried this, but it doesn't work.
    – user134969
    Mar 4, 2017 at 21:21
  • 2
    What did you try? What does not work? What does it do instead? What version of OpenSSH are you using?
    – Martin Prikryl
    Mar 5, 2017 at 6:44
  • Doesn't work a specific user as it is not usable in a Match block
    – Erdal G.
    Aug 24, 2017 at 12:44
  • @ErdalG. You are right. I've removed that part. You can use ForceCommand though (but that would disallow shell access, what you actually want to do anyway probably, if you want to limit what user can do).
    – Martin Prikryl
    Aug 24, 2017 at 12:49
0

You can only pass args to the sftp command when using ForceCommand, not Subsystem. If you do what the other answer says, the -P arg will be silently ignored!

The correct way:

Subsystem sftp internal-sftp

ForceCommand internal-sftp -P symlink

(you possibly also want to put a Match block around the second line)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .