Can I allow SFTP for ANY , but SSH for some IP address

davidklc · 07-20-2010, 12:40 AM

Dear All ,
Can I allow SFTP for ANY , but SSH for some IP address

druuna · 07-20-2010, 01:56 AM

Hi,

I don't think that is possible with just one running instance of the sshd daemon (scp, ssh and sftp are managed by this daemon). I'm sure it is possible if you set up 2 sshd daemons (both listening on a different port).

But what is the underlying problem?

If you do not want to give everybody a shell and remote execution rights ("basic" ssh) but do want to give secure upload/download access to "everyone" you might want to take a look at scponly (provide access to remote users to both read and write local files without providing any remote execution privileges).

Scponly - main page
Scponly - FAQ

Hope this helps.

davidklc · 07-20-2010, 02:42 AM

Hi ,
I've already config SFTP user as

sftpuser:x:2222:2000:SFTP User:/var/ftp/upload/sftpuser:/usr/libexec/openssh/sftp-server

grep 2000 /etc/group
sftponly:x:2000:

/usr/local/etc/sshd_config
Subsystem sftp internal-sftp
Match group sftponly
ChrootDirectory /var/ftp/upload/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

So , the SFTP user is allow for ANY ( if firewall is allow )

But , I hope the Unix Server can let me config as SFTP for ANY , but SSH for some IP .

since TCP wrapper are only for SSHD service deamon as /etc/hosts.allow & /etc/hosts.deny
and can not config as
SFTP: ALL :allow
SSH : x.x.x.x y.y.y.y :allow

( not sure rssh can or can not )

anomie · 07-20-2010, 12:44 PM

What OS / version, and - more importantly - what OpenSSH version?

davidklc · 07-21-2010, 02:10 AM

Quote:

Originally Posted by anomie

What OS / version, and - more importantly - what OpenSSH version?

more /etc/redhat-release
Red Hat Enterprise Linux Server release 5.5 (Tikanga)

/usr/local/sbin/sshd
OpenSSH_5.5p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008

anomie · 07-21-2010, 12:37 PM

Neat - you compiled your own current version of OpenSSH on RHEL.

I haven't tinkered with the newer versions, but sshd_config(5) seems to indicate that the Match directive will support what you want to do.

Can you not do something like..

Code:

...

# Remember to explicitly turn off all 
# authentication forms globally. The 
# needed forms should be activated in 
# the Match blocks to fine tune access
# control. 

PasswordAuthentication no

# Here we implicitly allow ssh from a couple 
# subnets 

Match address 192.168.50.0/24,192.168.51.0/24
  PasswordAuthentication yes

# Here we match all addresses for sftp; this 
# may be incorrect, and you may need to do some
# magic with a negation PATTERN

Match address *
  ChrootDirectory /var/ftp/upload/%u
  ForceCommand internal-sftp
  PasswordAuthentication yes

...

Now then, this is untested. I don't know if it's even syntactically correct. But the theory seems right to me.

saifkhan123 · 07-23-2010, 05:57 AM

Quote:

by "anomie": Now then, this is untested. I don't know if it's even syntactically correct. But the theory seems right to me.

Well, Match directive works really fine for me, i have the same setup and its working fine. The "ForceCommand SFTP" directive prevents the user from accessing the Shell, and he can only access SFTP.