Restrict ssh access

[TSch]

Hi folks,

is it possible to restrict ssh access to a certain directory only ?

Let's say user xyz is only allowed /u01/ including all subdirectories. He is not to be allowed access to all other directories like /etc/ , /usr/ , and so on ...

Is it possible ? If so how can it be done ?

Regards
Thomas

 

[khalidaaa]

Hi Thomas,

Rod just posted this few days ago regarding restricting ssh:

http://www.tek-tips.com/viewthread.cfm?qid=1398376&page=1

Maybe this can be done by ACLs on the target machine!

http://unix.ittoolbox.com/documents/popular-q-and-a/access-control-lists-acls-in-aix-3013

Regards,
Khalid

 

[ogniemi]

hmmm...

maybe you could include the user on DenyUsers list in your openssh config and run second but chroot'ed openssh on another port for this user???

http://ulf.zeitform.de/en/documents/sshchroot.html

 

[RodKnowlton]

In order for user xyz to have no access at all to /etc or /usr, you'd have to tighten the permissions on those directories in a fashion that would lock the machine to pretty much anyone but root. That, or set up a chroot environment like ogniemi suggested.

Can you tell us what user xyz should be allowed to do? Do they need the command line, or could their needs be met with a script?

- Rod


IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

A Simple Code for Posting on the Web

 

[TSch]

Hi folks,

we need a certain user for an external companies remote support access.

We're running two separate applications on the system and the external company mentioned above shall only be allowed to move through their directory structure.

They have to be able to read, write, execute files under their directory structure and nowwhere else ...

Regards
Thomas

 

[RodKnowlton]

For the account to even function, there are files outside of their directory structure that they'll have to be able to read and/or execute.

You can try the chroot approach, but it can be tricky just getting a single daemon to run under chroot. An entire application is going to be a nightmare, if not impossible.

Other options are LPARs (which you'd probably already be using if you had the option) or purchasing a new machine to support their application.

Since you have a business relationship with them, the most practical solution is probably contractual, rather than technical.

After all, if you can't trust them to stick to a contract that forbids them from accessing anything other than their own directory, how can you trust their software?

- Rod


IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

A Simple Code for Posting on the Web