1

there are many solutions described to get ur SSH-connection forced to only run SFTP by modifying the sshd_config by adding a new group match and give that new group a Forcecommand internal-sftp

Well that works great but i would love to have a little more feature.

My servers automatically ban IP's which try to connect often in a short time. So when you use any SFTP-Client, which opens multiple connections to work faster it can get banned instandly by the server for a long time.

The servers have a script to whitelist users by administrator. I've modified this script to whitelist the user, which runs the script.

All i need to do is now get the server to execute that script, when somebody logins. On SSH it's no problem, just put it in .bashrc or something like, but the Forcecommand don't runs these scripts on login.

Is there any way to run such a shellscript before or at the same time as the Forcecommand get fired?

2
  • 1
    If you're running something like fail2ban, then you should be banning IPs which fail to login, not those which succeed. Oct 20, 2012 at 12:17
  • im using netfilter, which just ban IPs based on iptables.
    – Chris
    Oct 20, 2012 at 14:03

1 Answer 1

0

if the problem you are having is people trying to brute force their way in, try changing the port that your sftp server is on. People generally only spam port 22.

1
  • i dont wanted to change my security methods that way - IP-filter is a must have for me.
    – Chris
    Oct 22, 2012 at 20:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .