4

I am using WinSCP for connecting ftp to Linux Instance and I want to restrict special user and host.

I install plesk on my Linux Ec2 instance and I thought it is using proftpd for ftp service and xinetd for service name.

So I config /etc/proftpd.conf and sudo service xinetd restart, but It was not working.

So I decided to change the /etc/hosts.allow and /etc/hosts.deny and config like this

/etc/hosts.allow:

sshd: 1.2.3.4

/etc/hosts.deny:

sshd: ALL

It's working. But I want to restrict special user and host means one IP address can access with only one username.

So I tried

sshd: username@ipaddress

But I was not working.

My final goal is to one user can access with one IP address to one folder.

1 Answer 1

3

The line sshd: username@ipaddress in /etc/hosts.allow would apply the restriction to the sshd service (and only if it was compiled with libwrap support or configured to use TCP wrappers). It does nothing at all to proftpd.

If you are using the scp or SFTP mode of WinSCP to connect, you are effectively using the sshd service, and the proftpd will not be involved at all. If you are using a FTP or FTPS mode, then proftpd could handle those, and sshd will not be involved at all.

(Running an unnecessary service with a poorly-understood configuration on an internet-accessible server is begging to be infected by malware. For the sake of yourself and the other users of EC2, please don't do that.)

Using the sshd: username@ipaddress form in /etc/hosts.allow requires that the client must be running identd or equivalent service. identd is a service that reveals the local username associated with an active TCP connection to anyone who asks. In modern times, this is deemed a dangerous and unnecessary information disclosure, and so the identd service is no longer enabled nor usually even installed by default on modern systems.

And if the client is not a Unix-like system maintained by someone you trust, the remote identd service might be configured to tell lies even if it exists and is not blocked by firewalls. To sum up, adding usernames to /etc/hosts.allow is not likely to be useful in a modern network environment.

You'll need to first accept incoming connections from every authorized client host, and then once they disclose the username they want to connect as (as part of the authentication procedure), you can reject the non-matching combinations.

With sshd, you could do it by adding something like this to your /etc/ssh/sshd_config file:

AllowUsers [email protected] [email protected] ...

Note that this will also restrict regular SSH connections, so make sure you don't lock yourself out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .