2

I've set up a user with chroot that has access to only 1 directory through sshd's sftp so that one of my coworkers can upload certain kinds of files. I'm then going to make a way to trigger a command through HTTP that will run a long process on the files, and I need to disable sftp while the process is being run.

Is there a command I can use to disable sftp without having to change the sshd_config file and reload the service? I was thinking of doing port blocking, but I still need access to ssh.

I read about disabling the user account with passwd -l, but if it's already logged in through sftp it would still allow modification.

Any suggestions?

Edit:

After some more dabbling I found out that I could do ps -axl | grep $user@notty and send a kill -9 to the PID to disconnect the user from It's current session and then either do passwd -l username to prevent the user from logging in again or as Martin suggested remove the symlink to the sftp-server binary.

But in the end I took Mike's advice and just moved the files somewhere else instead of running the process in the chroot directory.

2
  • 1
    Are you wanting to disable sftp so that your coworker can't modify the files they've uploaded while this long process is running? If so, have you considered moving the uploaded files out of their chroot as the first step of the long process? May 29 '17 at 19:00
  • I don't know why I didn't think of doing that... I think I'll take this approach instead, thanks for the suggestion. May 29 '17 at 19:16
2

You can temporarily remove write permissions to the folder.


If you want to disable SFTP completely, you can create a symlink to sftp-server binary. And configure the user to use that symlink as SFTP binary. Then you can just temporarily remove the symlink, what will effectively disable the SFTP.

Match User theuser
    ForceCommand /path/to/sftp/symlink
2
  • would removing the symlink kill the logged in user? May 29 '17 at 18:31
  • No, it won't. To kill an existing sessions, you have to kill all user-owned processes of sftp-server. May 29 '17 at 18:37
1

Note that disabling sftp on a system-wide scale is probably unideal, as sftp then becomes completely unavailable for all other possible tasks (both using the current design, and the future design). The better design (retaining long-term flexibility) is probably to control the "write" permissions of certain data (as noted by the first solution of Martin Prikryl's better multi-solution answer).

I choose not to duplicate (or try to complete with) Martin Prikryl's better multi-solution answer, which doesn't involve changing sshd_config file nor reloading the service.

However, for the sake of education/familiarity, I will share another option.

without having to change the sshd_config file and reload the service?

You could change the sshd_config file, but not reload the service. (So, as requested, you're not doing both.)

Then send a SIGHUP to the parent sshd service. (Make sure it's the parent: SIGHUPping another sshd service may kill a connection.) The easy way to identify which process is the parent may be to use a PID file.

e.g., if sshd is making this pid file:
sudo kill -HUP $( sudo cat /var/run/sshd.pid )

(The default name/location of the PID file can vary between different operating systems.)

SIGHUPping the parent will cause sshd to reload the configuration file (because that is how sshd was designed). Note that this might not stop any currently-running sftp sessions (and modifying the binary file on the disk might also not do that), so make sure that's handled before you move onto your sensitive can't-have-sftp-running process.

-1

You can reconfigure firewall services to block the sftp ports in use.

1
  • The outbound ports?, can't disabled the inbound(22) because i need to be able to login with my user through ssh May 29 '17 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.