0

There is a server running sshd. We have root permission on it.

Question: How can we disable SCP on it, BUT: allow a given IP to SCP (copy to it, etc.)

Maybe rename the SCP binary and have a "Match User root" entry with the correct scp path or how?

UPDATE: all access should be allowed, only scp need to be blocked*. *but whitelist given IP's for scp

6
  • Do other ISPs need to be able to access that machine as well? And if so, in what way? – Faheem Mitha Jun 10 '15 at 8:57
  • I updated the question, hope it clarifies it. – LoukiosValentine79 Jun 10 '15 at 9:16
  • So ssh should be allowed for all ISPs, for example? – Faheem Mitha Jun 10 '15 at 9:17
  • You cannot prevent users from transfering files by disabling scp. There's many other loopholes like tar, rsync, shar, etc. – yaegashi Jun 10 '15 at 9:40
  • 1
    Blocking only SCP seems like a lot of effort for no benefit. If the user can still run SFTP or has access to the unix command line, there are lots of other ways to transfer files. – Kenster Jun 10 '15 at 13:31
1

You could use the ~/.ssh/authorized_keys to restrict what the users can do;

command="/noscp.sh" ssh-dss blablabla== whatever@user.email

;

#!/bin/sh

if [[ "$SSH_ORIGINAL_COMMAND" =~ scp* -a ! "$SSH_CLIENT" =~ 10.10.10.10* ]] ; then
   echo "Rejected" >&2
   echo "$(date) fail $SSH_CLIENT $SSH_ORIGINAL_COMMAND" >> noscp.log
   exit 1
else
   $SSH_ORIGINAL_COMMAND
fi
exit

Although this is doable it would be best if you told us your goal as it's pointless to block scp when files can be copied directly through ssh, etc. It generally makes more sense to simply limit functionality by user ssh key not user source IP.

1
  • the answer looks good, but I am still waiting, maybe others know another way, Thank you! – LoukiosValentine79 Jun 10 '15 at 10:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.