Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Can I set up accounts that can do SCP that are NOT local users (i.e. users with an entry in /etc/passwd)? I've tried googling for SCP "without PAM authentication" or alternative authenication for sshd but I have not yet found anything that I can use.

In other words: How can I configure SCP access on my Debian machine without having to create a new local account/local user?

Doing this would be useful example in the case of a webhost with several VirtualHost entries in httpd.conf allowing people to securely upload their website assets without the admin having to create an account and setup SSHd to point to their htdocs directory as their home directory.

share|improve this question
4  
how are your website owners going to authenticate? password? stored where? public key? again, stored where? also, given that all vhost directories will be owned by the one user (e.g. www-data or apache), what's to stop webuserA from overwriting or downloading files belonging to webuserB? I've always taken advantage of the unix permission/ownership model and set up vhosts so that they have a dedicated user and home directory and (using e.g. apache2-mpm-itk) their site's scripts are run as that user, and all files belonging to a vhost are in their home dir, and owned by that user. –  cas Sep 18 '12 at 11:37
1  
You can have a script add user accounts automatically –  artistoex Sep 18 '12 at 13:26
1  
ssh need to native account. –  Mohsen Pahlevanzadeh Sep 18 '12 at 21:55
add comment

1 Answer

up vote 2 down vote accepted

ProFTPD can be used in the manner you describe; its mod_sftp module supports SCP and it can use a variety of user authentication mechanisms. Before jumping in, you should be cognizant of these facts:

  • You will be broadening the attack surface area of your server
  • ProFTPD has suffered more frequent and severe security vulnerabilities than OpenSSH in the past couple years
  • Your ProFTPD SCP service and OpenSSH cannot share port 22

I have personal experience using this solution at a large enterprise for the exact reason you outline -- remote users must not have local system accounts (a service requirement for that particular user base). The only additional caveat I'll add is that the configuration can be daunting to accomplish the same degree of user separation that typical system accounts offer. By the same token, ProFTPD's extremely flexible configuration offers more interesting access control possibilities than OpenSSH.

share|improve this answer
    
I've just implemented the same thing using ProFTPd. Seems to be working. Thanks Eli. Also if you could edit your answer with suggestions on how to mitigate the security risks posed by adding yet another daemon listening on a server, that would help a great deal. But I consider this question answered. Thanks again. –  emk Oct 9 '12 at 8:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.