OpenSSH
[Top] [All Lists]

Re: sftp issue

To: "Panchacharam, Sathiyaseelan non Unisys" <Sathiyaseelan.Panchacharam@unisys.com>
Subject: Re: sftp issue
From: Darren Tucker <dtucker@zip.com.au>
Date: Thu, 04 Jan 2007 14:31:54 +1100
Cc: openssh-unix-dev@mindrot.org
Delivered-to: sp-com-lists@consult.net
Delivered-to: openssh-unix-dev-list1@securepoint.com
Delivered-to: openssh-unix-dev-tmda@mindrot.org
Delivered-to: openssh-unix-dev@mindrot.org
In-reply-to: <45B258C006C6954AB0B2FA2EF5D76076045732AA@USEA-EXCH3.na.uis.unisys.com>
List-archive: <http://lists.mindrot.org/pipermail/openssh-unix-dev>
List-help: <mailto:openssh-unix-dev-request@mindrot.org?subject=help>
List-id: Development of portable OpenSSH <openssh-unix-dev.mindrot.org>
List-post: <mailto:openssh-unix-dev@mindrot.org>
List-subscribe: <http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev>, <mailto:openssh-unix-dev-request@mindrot.org?subject=subscribe>
List-unsubscribe: <http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev>, <mailto:openssh-unix-dev-request@mindrot.org?subject=unsubscribe>
References: <45B258C006C6954AB0B2FA2EF5D76076045732AA@USEA-EXCH3.na.uis.unisys.com>
Sender: openssh-unix-dev-bounces+openssh-unix-dev-list1=securepoint.com@mindrot.org
User-agent: Thunderbird 1.5.0.9 (Windows/20061207)
Panchacharam, Sathiyaseelan non Unisys wrote:
> I have problem in sftp using a user exn the sftp -v output is given
> below. Could someone help me in this?
> 
> The user detail is as follows. The shell we are using is /bin/false is
> it creating problem?

Yes.  sshd tries to run sftp-server using the user's shell (via the "-c"
option) which doesn't work with /bin/false as the shell.

You have a few options:

1) set the user's shell to be /path/to/sftp-server.  This works with
current versions but it's not very elegant.

2) If you're using OpenSSH 4.4 or up, you can set a real shell then use
"Match User exn" then "ForceCommand /path/to/sftp-server" in
sshd_config.  This will only restrict access via ssh though, so if the
user has access to, eg, telnet, they'll get a shell.

3) Use one of the restricted shells built for this purpose (eg scponly
or rssh).

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@mindrot.org
http://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

<Prev in Thread] Current Thread [Next in Thread>
  • sftp issue, Panchacharam, Sathiyaseelan non Unisys
    • Re: sftp issue, Darren Tucker <=