Home / server / Questions / 44707
Accepted
robcast
Asked: 2009-07-24 08:14:19 +0800 CST

How to restrict everyone except a certain group in SSH?

  • 772

I want to restrict all users on a server to only be able to use SFTP while the members of an admin group should have full SSH access.

I found that it is possible to restrict the members of a group by using Match Group and ForceCommand. But I found no logical negation. So I tried to construct it in reverse:

# SFTP only, full access only for admin group
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

Match Group admin
    X11Forwarding yes
    AllowTcpForwarding yes
    ForceCommand /usr/local/sbin/ssh-allowcmd.sh

and built a script ssh-allowcmd.sh that executes either the given command or /bin/bash for interactive access.

Is there a better solution?

ssh sftp

4 Answers

  1. Best Answer

    If you're using OpenSSH 5.1 or later then it supports Match Group negation.

    Assuming the defaults are OK for the admin group, then just change everyone else:

    Match Group *,!admin
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp

    There's really no reason to rely on third-party shells to do this kind of job with recent OpenSSH releases.

    • 22

  2. I use MySecureShell to limit users to SFTP only connections. I do this for specific users, but I am sure you can configure it to limit by default so the exemption would be for you to give shell access as well.

    http://mysecureshell.sourceforge.net/

    • 3

  3. What you want is scponly. IF you're running Debian/Ubuntu it's in the repos. Once installed, you just do the following:

    $ sudo chsh -s /usr/bin/scponly username

    It also allows you to chroot the users.

    Alternatively you can do the following:

    $ usermod -s /usr/lib/sftp-server username
$ echo '/usr/lib/sftp-server' >> /etc/shells

    The first line restricts the user's shell to sftp. The second line is to make sftp-server a valid shell.

    As you didn't specify the OS that you are using, I am unable to tailor the commands to your specific needs.

    • 2

  4. If the users don't need access to the same files, but rather you don't want to set up a second server just for sftp, I would recommend virtualization instead. You can install OpenVZ and setup very light weight VMs to handle this.

    If this is accurate to your situation, you will probably find the OpenVZ installation will come in handy for other stuff like this as well over time.

    • 0