4

I've got a remote server my.server.com and I'd like to allow another user (stranger) to scp files onto the box.

Goals:

  • give as little access to the stranger user as possible
  • stranger should not be able to log in at all
  • if possible, arrange one-way copying - they should only be able to copy files onto the sever, not off

How can I accomplish this?

Edit: I've removed all the cross posts. This question only exists here. Please help!

Edit 2: I ended up settling for a normal scp transfer. Selected @Lambert's answer because it was the most complete. Thanks for all the help!

  • I've removed all the cross posts. This questions only exists here. Please help! – beane Jun 25 '15 at 19:33
  • You could set the login shell (using chsh, or by editing /etc/passwd) to /bin/true – Basile Starynkevitch Jun 25 '15 at 19:42
  • You can use file-permission, including the sticky bit. This will allow removal of users own files, only. (Not quite stop all together, but may be what you need.) – ctrl-alt-delor Jun 25 '15 at 20:10
3

If you want all setup all the limiting stuff you mention I would suggest to use ProFTPd.

Using the sftp_module you are able to only allow a secure session. See http://www.proftpd.org/docs/contrib/mod_sftp.html for details about the sftp functionality. Near the bottom of the page an example configuration is listed.

Using the DefaultRoot directive you can isolate the granted user into his/her own directory

Using the <LIMIT> structure you are able to limit the FTP commands you want to allow, i.e. READ so the user can not retrieve files. See http://www.proftpd.org/docs/howto/Limit.html for details.

When you setup the sftp configuration in ProFTPd you probably want to have it to listen on another port than ssh, for example 2222. Configure your firewall and/or router to allow traffic coming from stranger to the port you choose for ProFTPd. Another possibility is to run ProFTPd's sftp module on port 22 and reconfigure ssh to listen on another port.

A sample configuration can look like:

<IfModule mod_sftp.c>
  <VirtualHost a.b.c.d>
    # The SFTP configuration
    Port 2222

    SFTPEngine on
    SFTPLog /var/log/proftpd_sftp.log

    # Configure the RSA, DSA, and ECDSA host keys, using the same host key
    # files that OpenSSH uses. 
    SFTPHostKey /etc/ssh_host_rsa_key
    SFTPHostKey /etc/ssh_host_dsa_key
    SFTPHostKey /etc/ssh_host_ecdsa_key

    <Limit READ>
      DenyAll
    </Limit>

    DefaultRoot ~ users,!staff

  </VirtualHost>
</IfModule>

Note: This is not a complete configuration of ProFTPd, you should review and modify the ProFTPd default configuration to have it fits your need.


There is another possibility to just use OpenSSH for this:

Create the user stranger and set a password for the user:

useradd -m -d /home/stranger -s /bin/true stranger
passwd stranger

Edit the file /etc/ssh/sshd_config and check if the following line exists, add it if it does not exists:

Subsystem       sftp    internal-sftp

Next add a Match block at the bottom of /etc/ssh/sshd_config:

Match User stranger
    ChrootDirectory  %h
    ForceCommand  internal-sftp -P read,remove
    AllowTcpForwarding no

Note: the user will be able to overwrite an existing file.

Restart the sshd daemon.

Set the owner of the directory /home/stranger to root:

chown root:stranger /home/stranger

Note: root must be the owner and may be the only one to have write permission if ChrootDirectory is used. An alternative might be to add -d %u to the ForceCommand internal-sftp line and set ChrootDirectory /home but a user will be able to cd / and see other usernames with ls

Create an upload directory for the user:

mkdir /home/stranger/upload; chown stranger:stranger /home/stranger/upload

Now you can logon as user stranger using:

sftp stranger@somehost

When you upload a file it should be ok:

sftp> put myfile
Uploading myfile to /upload/myfile
myfile                               100%   17     0.0KB/s   00:00    
sftp> get myfile
Fetching /upload/myfile to myfile
/upload/myfile                         0%    0     0.0KB/s   --:-- ETA
Couldn't read from remote file "/upload/myfile" : Permission denied
  • Thanks! Can you or @user 567 recommend any good tutorials on ftp access without any non-standard tools? I'd prefer to avoid installing anything extra if I don't have to. – beane Jun 25 '15 at 20:00
  • ProFTPd is pretty standard to setup a secure (s)FTP server. Which standard tools are you thinking of? – Lambert Jun 25 '15 at 20:07
  • Ideally I'd like to use something installed by default on my machine. I know next to nothing about ftp, but my guess is that I could do the same thing with sftp. Is that right? – beane Jun 25 '15 at 20:10
  • I managed to work something out with just OpenSSH, see my updated answer. – Lambert Jun 25 '15 at 22:07
  • This looks really promising - thank you, @Lambert! I'll check this out as soon as I have a chance. – beane Jun 26 '15 at 2:33
1

Personally, if the goal is to just allow the copying of files to the server, I would go the route of sftp instead of scp. scp presumes ssh access and if there is no need to provide shell access, better not to try and lock it down for just file transfers.

So, sftp. Some recommendations. Disable normal FTP and instead run something that allows you to easily control access which you can also have running on a unique port using sftp. I just finished configured proftpd on a server for example and it does the job quite nicely. You can chroot the access so that the users land in their home directory and cannot navigate your entire tree. You can also define what commands you allow, so for example disable 'cd' entirely, etc. You can also control FTP users aside from *nix accounts, so you can create this user account only in the context of FTP and not actually have an account for the user.

Additionally (for a belt and suspenders approach) from an OS level you can change the permissions on the users home directory (where their SFTP session would connect to) so that they only have the ability to write and not read (but again, you can limit commands with a ftp daemon like proftpd so that they can't do a get as well).

I've used other ftp servers in the past (although the names escape me at the moment) and all seem to offer more control than the default ftp daemons, so I am sure others provide similar functionality (I only mention proftpd as I was just working on it, not due to any belief it is the best option).

  • Funny. Lambert and I must have been typing at the same time :) – user 567 Jun 25 '15 at 19:48
  • It kinda is. your comment made me chuckle anyway. – mikeserv Jun 25 '15 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.