Re: [lopsa-tech] securing scp

2013-03-02 Thread James R Grinter
On 28/02/2013 15:51, Tony Del Porto wrote: If you go down the force command route, another trick is to write a script with the set of valid commands, and then use that script as the force command. One benefit is the ability to change the force command without having to edit authorized_keys for ev

Re: [lopsa-tech] securing scp

2013-02-28 Thread Travis
On Thu, Feb 28, 2013 at 7:08 AM, Andrew Hume wrote: > i would like to set up a server running centos 6 so that some specific > users > can transfer files in and do nothing else. > > We use proftpd with mod_sftp for this. It allows us to isolate the users in an easy way from other system users. I

Re: [lopsa-tech] securing scp

2013-02-28 Thread Tony Del Porto
On 2/28/2013 6:18 AM, Loic Tortay wrote: For the second method, I just insert something like no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding,from="ClientIPAddress",command="/usr/bin/scp -t DestDir" in front of the public key in the user's "~/.ssh/authorized_keys" (with a space b

Re: [lopsa-tech] securing scp

2013-02-28 Thread Loic Tortay
On 02/28/2013 02:08 PM, Andrew Hume wrote: > i would like to set up a server running centos 6 so that some specific users > can transfer files in and do nothing else. > > if they were using sftp, there are numerous pages detailing how to setup jails > and configure sshd to only do sftp-server. how

Re: [lopsa-tech] securing scp

2013-02-28 Thread John Stoffel
Andrew> i would like to set up a server running centos 6 so that some Andrew> specific users can transfer files in and do nothing else. Andrew> if they were using sftp, there are numerous pages detailing Andrew> how to setup jails and configure sshd to only do Andrew> sftp-server. how do i do tha

Re: [lopsa-tech] securing scp

2013-02-28 Thread David N. Blank-Edelman
On Feb 28, 2013, at 8:08 AM, Andrew Hume wrote: > how do i do that for scp? One way is to use something like this: https://github.com/scponly/scponly/wiki -- dNb ___ Tech mailing list Tech@lists.lopsa.org https://lists.lopsa.org/cgi-bin/mai

Re: [lopsa-tech] securing scp

2013-02-28 Thread Brandon Allbery
On Thu, Feb 28, 2013 at 8:08 AM, Andrew Hume wrote: > if they were using sftp, there are numerous pages detailing how to setup > jails > and configure sshd to only do sftp-server. how do i do that for scp? > by experiment, i can probably set up a jail and just have the scp binary, > but this seems