We have this requirement that we may able to communicate with each other by SSH but we cannot copy files from the other computer using SCP.

For example, we have 2 computers, which is computers 1 and 2. We can actually communicate with each other using SSH(tested it using terminal, ping each other using the ip address of the other computer or vice versa). And we can also copy each other's file using SCP. But then we had this requirement that computer1 should NOT able to get a file or send from/to computer2. And yet can still ping each other using each others IP ADDRESSES(using the terminal). And computer2 is like the master computer it has the capability of getting or sending file from computer1, while computer1 can ping computer2 using ip address but cannot send or receive any file from computer1.

Can someone help us with this requirement? I'm searching all over the internet and yet I can't find a solution.

And what are the codes should I be using?

Our topic is all about IPTABLES but then i can't see the logic of using it with IPTABLES or maybe i just don't know how to configure it, or there maybe other solutions you guys can suggest?

OPERATING SYSTEM: Linux Centos both computers

Thank you. This would be a very big help for me.

  • 1
    What do you mean by "ping each other using SSH"? What about "computerX can do this or that"? I'm asking because in context of SSH you rather block or give access to a user (identified by their login). Also note that even if you block SFTP and SCP subsystems somehow, the ability of running cat or few other tools on the remote side is enough to get any file you have read access to. A user that connects from computer1 to computer2 should be very restricted on computer2 to be unable to get any file. Thus "able to communicate each other" should be clarified. Please edit the question. – Kamil Maciorowski Sep 14 at 8:44
  • I already edited it now for more specific details. I am explaining here that the other computer must be restricted from getting/sending file from the other computer. I don't know how to configure this thing out. – David Sep 14 at 12:43
  • 1
    SCP uses SSH, it's like an extension/module of SSH. Everything is done over SSH. What you're trying to do seems impossible with iptables, since scp uses the same port that ssh uses, and if you can block either both or none. Other solution is configuring sshd_config. – Fanatique Sep 14 at 12:52
  • iptables on computer2 can block computer1 when it tries to initiate SSH connection to computer2. It will block any such connection; you cannot just block SCP alone because SSH connection is encrypted by default and you cannot tell from the outside which subsystem is in use. So this will also invalidate the "each other" part in the "ability to communicate with each other by SSH", whatever it means. – Kamil Maciorowski Sep 14 at 12:53
  • Very nice explained. What do you recommend, of what kind of configuration should i use from my explanation above? – David Sep 14 at 13:02

I am restating your need here to make sure I understand.

Computer2 must be able to ssh into Computer1.

Computer2 must be able to put files onto Computer1, and get files from Computer1 using scp.

Computer1 must not be able to ssh into Computer2.

Computer1 must not be able to scp into Computer2.

If the above is accurate, then you have a couple of options.

One option is to use ssh keys. Assuming the same user login is used on both Computer1 and Computer2, create a public/private key-pair for user-foo on Computer2. As user-foo on Computer2, run the command:

ssh-copy-id Computer1

You will be prompted to enter user-foo's password on Computer1. Once that is done though, from Computer2, user-foo will be able to ssh into Computer1 without being prompted for a password.

You can disable password authentication on Computer2 by setting

PasswordAuthentication no

in Computer2's sshd_config file and restarting the sshd service.

The other option is to set up a firewall rule on Computer2 to prevent any ssh connections from Computer1.

Hope this helps

  • Computer2 must be able to ssh into Computer1. Computer2 must be able to put files onto Computer1, and get files from Computer1 using scp. Computer1 MUST be able to ssh into Computer2. Computer1 must not be able to scp into Computer2. This is the right statement from all of my explanation. Can you guide me configuring this one and what configuration should i use? Thank you in advance – David Sep 14 at 16:27
  • As Fanatique said, scp is built on top of ssh. And as Kamil Maciorowski said, there are multiple ways to transfer files that do not require scp. For example, if you wanted to prevent user@Computer1 from copying Computer2's /etc/passwd file by disabling scp, user@Computer1 can still run – Lewis M Sep 14 at 17:10
  • sorry, didn't mean to post that soon. :) – Lewis M Sep 14 at 17:10
  • Need to figure out comments. :) Anyway, user@Computer1 can run, "ssh Computer2 cat /etc/passwd >/local/copy/of/Computer2/passwd" and still get a copy of it. So, preventing scp but still allowing ssh does not seem to buy you anything. – Lewis M Sep 14 at 17:12
  • Okay i get it, thank you for that informative answer.. What can you recommend transferring files with restriction from the other pc? – David Sep 17 at 6:41

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.