there are many solutions described to get ur SSH-connection forced to only run SFTP by modifying the sshd_config by adding a new group match and give that new group a Forcecommand internal-sftp

Well that works great but i would love to have a little more feature.

My servers automatically ban IP's which try to connect often in a short time. So when you use any SFTP-Client, which opens multiple connections to work faster it can get banned instandly by the server for a long time.

The servers have a script to whitelist users by administrator. I've modified this script to whitelist the user, which runs the script.

All i need to do is now get the server to execute that script, when somebody logins. On SSH it's no problem, just put it in .bashrc or something like, but the Forcecommand don't runs these scripts on login.

Is there any way to run such a shellscript before or at the same time as the Forcecommand get fired?

  • 1
    If you're running something like fail2ban, then you should be banning IPs which fail to login, not those which succeed. – Michael Hampton Oct 20 '12 at 12:17
  • im using netfilter, which just ban IPs based on iptables. – Chris Oct 20 '12 at 14:03

if the problem you are having is people trying to brute force their way in, try changing the port that your sftp server is on. People generally only spam port 22.

  • i dont wanted to change my security methods that way - IP-filter is a must have for me. – Chris Oct 22 '12 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.