| Summary: | Enhancement patch: Restrict sftp-server to basic commands, by user or group | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | Jeremy Monin <jdmossh> | ||||||
| Component: | sftp-server | Assignee: | Assigned to nobody <unassigned-bugs> | ||||||
| Status: | CLOSED WONTFIX | ||||||||
| Severity: | enhancement | CC: | cludvigg56, djm, jdmossh | ||||||
| Priority: | P2 | ||||||||
| Version: | 5.9p1 | ||||||||
| Hardware: | All | ||||||||
| OS: | All | ||||||||
| Attachments: |
|
||||||||
Created attachment 2129 [details]
Patch versus 5.9
hi jeremy, i just would like to ask on how to apply this patch?(sorry just a noob in linux) OpenSSH 6.5 added a more general request white/blacklisting feature. See the -p/-P flags to sftp-server. Although the Subsystem option isn't currently supported by sshd_config's Match (see bug #1975), it's possible to apply these to sftp-only accounts using ForceCommand closing resolved bugs as of 8.6p1 release |
Created attachment 2128 [details] Patch versus 5.9p1 This patch adds the ability to restrict an sftp-server user to just basic commands such as get, put, readdir, and readlink, and prohibit mkdir, rmdir, rename, symlink, setstat and their equivalents. It comes with an sshd_config option (RestrictSFtpSysToBasics) which can be global or in a Match block. I've found it helpful, and that request occasionally comes up on the openssh-unix-dev list. Please give feedback and consider it for inclusion. Patches are attached against both 5.9p1 and openbsd's 5.9. A more advanced enhancement might let the server admin specify which commands to permit/deny; I think this is a good start.