2

I have a Linux server (Ubuntu 16.04) where I run some simulations. I would like to give an employee access to this server so that he can test out his code (he would be accessing it remotely, from his personal computer), but not allow him to download any files from the server onto his system.

The files are pretty large (multiple GBs) so I'm not worried about him copy-pasting the entire contents of the file manually into his computer.

So how do I allow him SSH access, but disallow SCP/WinSCP access to him?

  • 4
    When you scp a file from a server (e.g. scp remote:file .) then it runs the scp command on the server as well. So if you remove the scp command then they can't copy files. But, of course, they could still do ssh remote cat file > local_file and get the file that way. You can't stop that without a restricted shell configuration which is much harder to setup. – Stephen Harris Mar 21 at 2:22
  • 1
    Is said user supposed to be able to access said files on the server but unable to download them? If access is not supposed to happen at all, file permissions are sufficient – Fox Mar 21 at 7:07
  • Just tell the dev it's against the rules, make them sign something. If you don't trust them, don't let them access the server, and doo not use their code. If they have ssh access, they can download everything, and if they're able to develop code, they know better ways than to copy-paste, as you naively assume. To get an idea, go search for FISH (the file transfer protocol used by mc, not the shell or the aquatic animal). – pizdelect Mar 21 at 8:36
  • If I was disconnected every 5 minutes, then the first thing that I would be thinking, is: How do I write a script to download the data, so that I can process it locally. It should not take long to figure that one out. If you let them read/download the output of a program that takes the secret data as input, then they can take any part that they want. You question is how do I allow someone to read the data, without letting them read the data. – ctrl-alt-delor Mar 21 at 9:33
2

I'm not sure you can do that if they really want to move the data away. You might be able to prevent running scp or sftp, but that still leaves many other ways of transferring files.

First, the really simple file transfer protocol is this:

ssh user@hostname 'cat /some/remote/file' > /some/local/path

And you can replace cat with almost any program, heck, even cp somefile /dev/stdout seems to work.

In the comments there were suggestions about disconnecting sessions after a particular time or after a particular amount of data transferred. That seems to work on the surface, if you also limit the number of connections the user can make. Allowing 10 connections a day, with a limit of 1 MB / connection, would limit them to moving just 10 MB. Perhaps something like that could be made to work if the normal intended use requires much less data transfer than the unwanted scenario.

But what if they just send the file somewhere else? It should be easy to set up an SSH/FTP/whatever server somewhere else and send the file through that. Or via HTTP(S), at least curl has options like --data @filename and --upload-file, and setting up the server side shouldn't be hard. If you remove the already existing tools, what if the program they run on the system sends the data away while/instead of processing it?


What you would need to do, is to limit what the program having access to the data can do with some kind of a sandbox.

Arrange for the code to run in a virtual machine that has no access to the outside, other than some interface for uploading the code and downloading the results, with appropriate controls for what gets accepted as a valid upload and a valid result. Or use somthing like seccomp to limit what the code can do.

| improve this answer | |
  • The only "practical" thing that would prevent BULK download with ssh is to rate-limit the ssh connections (eg. at 256kb/s, it would take them ~10 hours to download a 1G file, while still being perfectly usable for an interactive ssh session), but how to do that should be to subject of a separate questions. – pizdelect Mar 21 at 12:34
  • Limiting a user to 10 connections / day, or some data cap like 1MB / connection is not practical, because a user may trip that limit just because of some flaky connection, or because they forgot to add a | tail to some command. Also, since the developer is supposed to access those files as part of their job, seccomp won't help. – pizdelect Mar 21 at 13:15
  • @pizdelect, sure, you're free to write your own answer about bandwidth limiting or contractual restrictions. The idea for limiting the amount of data per connection, and the number of connections per time unit comes from the comments, like I wrote above. That's also the only reason I mentioned it. The question says that the employee needs to be able to "test out [their] code", which sounds like some sort of mass processing, not having to look at individual pieces of the data. For that, seccomp just might work, though of course it depends on what the output is supposed to be. – ilkkachu Mar 21 at 14:35
  • @pizdelect unfortunately I'm from a country where the legal system would be unreliable, at best. So that's not much of a hindrance. – alphaomega83 Mar 21 at 15:21
  • @ilkkachu I'm not looking to protect the data from a master hacker - I just want to make the obvious methods (SCP/WinSCP) unusable. Otherwise I'm sure any block would have a workaround to it – alphaomega83 Mar 21 at 15:23
-2

you can edit /etc/ssh/sshd_config to following

ForceCommand           /bin/sh
PermitOpen             0.0.0.0
AllowTcpForwarding     no
PermitTunnel           no
# Subsystem sftp       /usr/lib/openssh/sftp-server
PermitUserEnvironment  no

and remove scp from the server and also remove sudo access to his account. you can add scp back on need basis.

courtesy Brad and Mike's answers from https://serverfault.com/questions/28858/is-it-possible-to-prevent-scp-while-still-allowing-ssh-access

| improve this answer | |
  • 2
    That isn't viable because an environment may be needed for other purposes. scp may also be needed by other users. There would also be nothing to stop the user from compiling scp from source on the machine and using it that way. It would all be useless anyway because if the user can read the file, he can open up two shell sessions and use one to copy the contents of the file and the other to paste it elsewhere. He can also ssh user@machine (cat file) > local_file. – Nasir Riley Mar 21 at 4:02
  • Ok, in that case can I configure the server to disconnect all active connections, say, every 5 minutes? Or disallow bytes transfer of more than 1000 kilobytes? – alphaomega83 Mar 21 at 5:01
  • @alphaomega83 How is anyone supposed to do anything if you disconnect connections every 5 minutes? Is no one ever going to need to transfer more than 1000KB? – Nasir Riley Mar 21 at 5:42
  • That's the thing, I don't want them to transfer anything at all. They should just be able to run code on the data files that are stored on the server - leave the code running overnight and check the output next morning. And as for 5 minute disconnects, it would be annoying but I can live with that - file security is much more important. – alphaomega83 Mar 21 at 7:01
  • 1
    @alphaomega83 they can transfer the file piecewise. I'm not a whizz kid, but it would take me 10 minutes to script that. What you want to do has NOTHING TO DO with "security". – pizdelect Mar 21 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.