Dotaz: sftp nebezi

[Lithius]

Dobry den, nainstaloval jsem si rssh aby se ke me mohli prihlasovat uzivatele a byli omezeni pouze na scp a sftp. v configu mam nastaveno :

user=nekdo:011:00011:"/home/nekdo" tudiz bych mel mit poholeno scp a sftp. Pripojuji se z pocitace s windows pres winscp ale to mi pise chybovou hlasku ze "Nepodarilo se inicializovat SFTP protokol. Bezi SFTP server ? "

pokus se zkousim pripojit k memu normalnimu uctu...tzn mam nastaven Shell : /bin/bash tak vse funguje jak ma.

Prosim poradte jak to vyresit.

Mam Kubuntu fiesty fawn AMD64.

Odpovědi

[Dan1]

nevim, zda to pomuze, ale kdyz jsem instaloval scponly (= scp-only v chrootu), tak jsem se stejnou hlaskou taky bojoval sftp-server v chrootu totiz potreboval /dev/null jinak nenastartoval

takze:

cd /cesta/k/chroot/
mkdir dev
cd dev
mknod -m 666 null c 1 3

[Lithius]

tak tohle bohuzel nepomohlo

[lada]

jestli jsem to dobre pochopil, tak chces aby se nekdo mohl k na stroj pripojit pomoci scp nebo sftp, a to z windows.
nevim jak je to v kubuntu, ale v tom co znam a pouzivam (suse,mandriva,fedora) je zapotrebi pouze spustit sshd (ssh daemon) a nastavit ho tak, aby se spoustel po startu stroje (je to obvykle v nejakych sluzbach)
a mozna rict firerwallu kdo se muze ke stroji pripojit (popripade jen dat do /etc/hosts.allow IP tech pripojovanych stroju) a to je vse
balik rssh neznam
snad to pomuze

[jiri.b]

$ grep sftp /etc/ssh/sshd_config
Subsystem       sftp    /usr/libexec/sftp-server

s nejvetsi pravdepodobnosti za to muze rssh. nebo je nastaven ten nejaky rssh-shell/udelatko v /etc/shells?

sftp only udelas pomoci 'ForceCommand' a 'Match' v sshd_config, bohuzel s tim chrootem je to slozitejsi... Kdyby to bylo jednoduche vyresit zkutecne bezpecne a jednodusse, tak uz by to vyvojari OpenSSH/OpenBSD uz davno do OpenSSH dali :)

ja zacal se systrace s sftp-server - resp.

systrace -aU /usr/libexec/sftp-server

(bohuzel s vicemene uspokojujicimi vysledky :), ale nemam na to cas...

na linuxu systrace funguje, bud v gentoo nebo na vsech distrech pomoci ptrace (no reseni to neni optimalini).

jine reseni by bylo nejaky RBAC - RSBAC? a politiku pro ten /usr/libexec/sftp-server vazanou na $USER, ktery se prihlasi...

PS: pri sftp-serveru nefunguje scp pac se jedna jen to cat presmerovany pres ssh a to vyzaduje jako stdout shell.

[xobot]

z rssh FAQ:

Q: I support Windows users who can't/won't learn how to use SSH command-line tools. Can't you make rssh work with WinSCP?

A: Absolutely not. It's not because I think Windows is a crappy operating system that should never be used whenever alternatives exist (though that's basically true)... This ties in with the previous question. WinSCP is a bit of a hack (though a good one -- no offense meant to the author) which provides a GUI front end to command-line ssh tools. It requires that the user be able to run commands through ssh to manipulate the file system. There's already a way to do this... with sftp. In order to make rssh work with WinSCP, I'd have to modify rssh to be able to run a number of other commands. This is, IMO, the wrong approach. Update: Recent versions of WinSCP allow you to use the SFTP protocol. If you use WinSCP with the SFTP protocol, it will work fine with rssh. See the WinSCP documentation for details of configuring it to use the SFTP protocol. If your version of WinSCP does not allow this, download a more recent version. If you want a GUI front end that works with rssh, that I can provide. Or at least tell you where to get it. Check out FileZilla, which is freeware, or SecureFX, which is commercial. Thanks to Paul C. Bryan for providing me with this information. There are also a number of commercial FTP clients that now also support sftp. WS-FTP Pro is one. There are others. Google is your friend.

[Lithius]

Pouzil jsem Scponly...sice to uzivatele nechrootuje, ale co se da delat...do moji slozky ma stejne zamezen pristup.

[jiri.b]

scponly chrootuje...

ale je to reseni jak noha :) /mount_point musi byt s exec,dev