I am aware that this is security through obscurity, however this is for training purposes and will not be accessible via the Internet. It will merely be used as an internal tool.

I have looked at the following link: How to disable sftp for some users, but keep ssh enabled?

The problem is that it doesn't answer my question which is described below:

I am attempting to setup a virtual server which allows one user to log in to the server using sftp, and another user to log in to the server using ssh.

The sftp portion works and is done by forcing internal-sftp within the sshd_config file shown further within this question. This part works as it disallows the user from logging into the server using ssh, and only allows them access to the sftp jail which I have created.

For the other user which is only meant to be able to access the Chroot jail via ssh, I am unsure of how to disallow access via sftp. The problem is that I have specifically created a chroot jail for that user to prevent commands such as ls and cat, however if the user accesses the server using sftp, they are able to use those commands.

The section within the /etc/ssh/sshd_config is as follows:

Match User test1
        ChrootDirectory /home/jail
        X11Forwarding no
        AllowTcpForwarding no

# Match Group sftpusers
Match User test2
        ChrootDirectory /sftp/guestuser
        ForceCommand internal-sftp
        AllowUsers test2

I have attempted to add:

ForceCommand Subsystem sftp /bin/false or
ForceCommand sftp /bin/false or
Subsystem sftp /bin/false or
Match User test1

However none of the aformentioned additions work with sshd_config.

So my question is:

Is there a way to prevent user1 from accessing the server via sftp? If not is there a way to remove certain commands from sftp, such as ls or cat?

Any advice would be greatly appreciated.

  • "however if the user accesses the server using sftp, they are able to use those commands" Could you clarify this? Are you saying they can use an sftp client to make a connection and then use the client's "ls" command to list files? More generally, are you trying to prevent these jailed users from using sftp at all, or just trying to limit what they can do through sftp? – Kenster Jul 26 '17 at 15:53
  • @Kenster I am attempting to prevent user1 from accessing sftp at all. – Kyhle Ohlinger Jul 26 '17 at 16:02
  • What is your "Subsystem sftp" line? Is there a copy of the sftp-server program inside of the jail? – Kenster Jul 26 '17 at 16:04
  • @Kenster It is a line that I read about within other posts, however it is not allowed within Match blocks. No there is no copy of the program within the jail – Kyhle Ohlinger Jul 26 '17 at 16:24
  • So, uh, what is the actual subsystem sftp line in your actual sshd_config file? – Kenster Jul 26 '17 at 16:28

The simplest way is to create some script that would take care of that. Add

Match User test1
  ForceCommand /path/to/your/script.sh

And your script will basically run whatever the user wants, unless it is request for SFTP:

if [[ "$SSH_ORIGINAL_COMMAND" =~ .*sftp-server.* ]]; then
   echo "SFTP not allowed"
   exit 255;
  • What should SSH_ORIGINAL_COMMAND be set to? At the moment it is not set to anything, which means that when the user is authenticated, ssh closes the connection immediately. – Kyhle Ohlinger Jul 28 '17 at 11:49
  • It should be set to the sftp server path unless you have internal-sftp configured. – Jakuje Jul 28 '17 at 13:31
  • I meant for the else exec part, where ssh should allow a connection. – Kyhle Ohlinger Jul 28 '17 at 13:40
  • It is the variable set up by the ssh server. If it is allowed, it executes what user wanted – Jakuje Jul 28 '17 at 15:16
  • for some reason it just closes the ssh connection without ever going into ssh. – Kyhle Ohlinger Aug 2 '17 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.