From owner-freebsd-questions@FreeBSD.ORG Tue Mar 11 22:18:34 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CA4B41065673 for ; Tue, 11 Mar 2008 22:18:34 +0000 (UTC) (envelope-from jerrymc@gizmo.acns.msu.edu) Received: from gizmo.acns.msu.edu (gizmo.acns.msu.edu [35.8.1.43]) by mx1.freebsd.org (Postfix) with ESMTP id 8E0F18FC24 for ; Tue, 11 Mar 2008 22:18:33 +0000 (UTC) (envelope-from jerrymc@gizmo.acns.msu.edu) Received: from gizmo.acns.msu.edu (localhost [127.0.0.1]) by gizmo.acns.msu.edu (8.13.6/8.13.6) with ESMTP id m2BMGAvj002464; Tue, 11 Mar 2008 18:16:10 -0400 (EDT) (envelope-from jerrymc@gizmo.acns.msu.edu) Received: (from jerrymc@localhost) by gizmo.acns.msu.edu (8.13.6/8.13.6/Submit) id m2BMGAHe002463; Tue, 11 Mar 2008 18:16:10 -0400 (EDT) (envelope-from jerrymc) Date: Tue, 11 Mar 2008 18:16:10 -0400 From: Jerry McAllister To: "Philip M. Gollucci" Message-ID: <20080311221610.GB2418@gizmo.acns.msu.edu> References: <47D702EC.2090908@riderway.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <47D702EC.2090908@riderway.com> User-Agent: Mutt/1.4.2.2i Cc: FreeBSD Questions Subject: Re: security/openssh-portable X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Mar 2008 22:18:34 -0000 On Tue, Mar 11, 2008 at 06:08:44PM -0400, Philip M. Gollucci wrote: > Hi, > > I'm setting up a 'chrooted' SFTP only set of users: > > /etc/make.conf: > .if ${.CURDIR:M*/usr/ports/security/openssh-portable*} > WITH_SUID_SSH =yes > WITH_OPENSSH_CHROOT =yes > WITH_HPN =yes > WITH_OVERWRITE_BASE =yes > .endif > > /etc/rc.conf: > sshd_enable="NO" > openssh_enable="YES" > > /etc/passwd: > user:*:3000:3000::0:0:F L:/foo/./user:/bin/sh > > Access will be with ssh dsa keys only. > > What is the best way to make this SFTP only and not SSH? > 1).ssh/authorization? > 2) change user's shell to /usr/local/libexec/sftp-server > 3) change user's shell to a custom C wrapper around [2] > 4) a combination of them The usual thing is make the shell /bin/nologin ////jerry > > -- > ------------------------------------------------------------------------ > Philip M. Gollucci (philip@ridecharge.com) > o:703.549.2050x206 > Senior System Admin - Riderway, Inc. > http://riderway.com / http://ridecharge.com > 1024D/EC88A0BF 0DE5 C55C 6BF3 B235 2DAB B89E 1324 9B4F EC88 A0BF > > Work like you don't need the money, > love like you'll never get hurt, > and dance like nobody's watching. > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"