0

I use SSH keys to allow passwordless logons to my box. I want to limit them to SFTP only.

I have the following in my authorized_keys file which appears to work:

command="internal-sftp" ssh-rsa ...

I can't seem to find a way around it...but I am no genius...am I actually secure?

Improve this question
7
  • Do you allow password authentication at all?
    – Aaron Miller
    May 1, 2013 at 14:07
  • No...nobody knows the password.
    – Cheetah
    May 1, 2013 at 14:33
  • That's not what I asked. In /etc/ssh/sshd_config or equivalent, is PasswordAuthentication set to yes or to no?
    – Aaron Miller
    May 1, 2013 at 15:04
  • @AaronMiller set to yes, but I can set that from the authorized_keys file though can't i?
    – Cheetah
    May 4, 2013 at 10:10
  • 1
    Much better methods detailed on SF: serverfault.com/q/354615/28549
    – Ben Voigt
    Jul 24, 2014 at 17:39

3 Answers 3

Reset to default
2

not really. One can just download the authorized_keys file, edit it removing the command="internal-sftp" part and upload it on top of yours and then ssh into the box.

Improve this answer
1
  • 1
    Yes, changing the shell is also needed, chroot jail is also a good practice. And forwarding can be a vulnerability as well. serverfault.com/a/354618/28549
    – Ben Voigt
    Jul 24, 2014 at 17:40
2

I think the proper way to configure this would be to add ForceCommand internal-sftp to the specific user section on sshd_config

Subsystem sftp internal-sftp

Match User MyUser
    PasswordAuthentication no
    ChallengeResponseAuthentication no
    ForceCommand internal-sftp
    ChrootDirectory /home/MyUser
Improve this answer
0

You should better also remove the password from the account (no matter that "nobody knows the password").

passwd --delete username

Other than that your solution seems ok.

Improve this answer
2
  • Sorry, I should have made it clearer. It already is a passwordless account.
    – Cheetah
    May 7, 2013 at 14:01
  • A passwordless account is an account that doesn't require a password to login. A disable password is a different thing. BE WARNED!
    – EnzoR
    Aug 31, 2017 at 9:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .