LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-14-2023, 05:32 PM   #1
udittomar52
LQ Newbie
 
Registered: Jun 2023
Posts: 1

Rep: Reputation: 0
restrict sftp but allow ssh


I want to restrict a user to do sftp to a particular directory in raspberry pi os but after successfully doing that i am unable to do ssh.

i have edited etc/ssh/sshd_config This is the configuration i have inserted in config file

Allowed Users admin
Subsystem sftp /usr/lib/openssh/sftp-server
Match User admin
ForceCommand internal-sftp -d /update
PermitTunnel no
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no

How to restrict sftp to a particular directory but ssh should also work......
 
Old 06-14-2023, 09:44 PM   #2
wpeckham
LQ Guru
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, VSIDO, tinycore, Q4OS, Manjaro
Posts: 5,763

Rep: Reputation: 2764Reputation: 2764Reputation: 2764Reputation: 2764Reputation: 2764Reputation: 2764Reputation: 2764Reputation: 2764Reputation: 2764Reputation: 2764Reputation: 2764
It is trivial to restrict a user to STP only. IT is trivial to restrict a user to a particular directory for both sftp and ssh.

It is unclear exactly what you want, but if you want ssh shell access unrestricted and file transfer restricted to a single tree, that is "interesting"! I cannot image why you would want such an odd animal, but I have a solution: it involves two listeners and ssh installations rather than one: with different configurations. SSH running on one port (22?) with sftp/scp blocked or disabled, and ssh restricted to a single folder and allowing ONLY sftp on a different port. This requires some manual duplication or linking of the key structures, or running two processes from the same install with very different command-lines and different sshd.conf files. (sshd.conf and sshd2.conf? Whatever.)

There may be another way. No, there are MANY other ways, I just cannot think of them right now. One would be to run OpenSSH (sshd) with a config that does not enable sftp, but run an ftp client that supports sftp sessions using that applications config and restrictions.

Of note, most people who want to restrict sftp also want to restrict or disable ssh sessions. This is actually BACKWARD to the normal cases!

If I have misunderstood, and I HOPE I have, please provide correction and clarification.
 
Old 06-15-2023, 12:07 AM   #3
JJJCR
Senior Member
 
Registered: Apr 2010
Posts: 2,167

Rep: Reputation: 449Reputation: 449Reputation: 449Reputation: 449Reputation: 449
check out this link if this is what you need: https://www.golinuxcloud.com/sftp-ch...fic-directory/

Below is from link above, I believe this is where the magic happens. Of course, other steps mentioned should not be missed.
Quote:
Step 4: Configure SFTP chroot jail
To configure SFTP chroot jail we will modify /etc/ssh/sshd_config


[root@server2 ~]# vim /etc/ssh/sshd_config
<output_trimmed>
#Comment sftp-server SubSystem and use internal-sftp
#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp

#Add this section to match for user "deepak"
Match user deepak
ChrootDirectory /opt/sftp-jails/deepak <-- Our sftp chroot jail directory
X11Forwarding no
AllowTcpForwarding no
PermitTunnel no
AllowAgentForwarding no
ForceCommand internal-sftp
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Can I allow SFTP for ANY , but SSH for some IP address davidklc Linux - Security 6 07-23-2010 05:57 AM
LXer: How to: Restrict Users to SCP and SFTP and Block SSH Shell Access with rssh LXer Syndicated Linux News 0 01-02-2008 12:40 PM
LXer: How to: Restrict Users to SCP and SFTP and Block SSH Shell Access with rssh LXer Syndicated Linux News 0 01-02-2008 12:00 PM
LXer: How to: Restrict Users to SCP and SFTP and Block SSH Shell Access with rssh LXer Syndicated Linux News 0 01-02-2008 10:00 AM
Restrict ssh/sftp with chroot? Chowroc Linux - Networking 4 01-25-2005 10:48 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:56 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration