1

On a CentOS 7 server, I'd like to configure it such that:

  1. It accepts SSH connections, like PuTTY
  2. It denies SCP/SFTP connections, like SCP, WinSCP, and FileZilla

Is such a configuration possible?

4
  • 1
    See possible solutions and other detail on the topic here: serverfault.com/questions/28858/… Oct 19 at 13:47
  • 31
    It does not make sense. If you allow a shell access, the user can do anything with the system. Disabling scp/sftp does not prevent the user from uploading/downloading files/data. It just makes it less convenient. Oct 19 at 13:49
  • 13
    This reads like an XY problem. You have indicated that you have a security problem (which you have not expressed) and you have asked for what you believe is the solution to this problem. Instead, perhaps ask a new Question where you state the security problem and obtain Answers that don't assume the solution you write about here as the starting point... Oct 20 at 18:27
  • If you give people shell access, they're going to be able to create files directly, as in simply echo my stuff>> newfile.sh.
    – Nelson
    Oct 21 at 10:14
35

It wouldn't help you because the user could trivially do:

ssh user@host "cat /path/to/file" > /local/path/to/file
cat /local/path/to/file | ssh user@host "cat - > /path/to/file"

to copy files down and up respectively.

2
5

Yes, you can.

To disable sftp, find the line that starts with Subsystem sftp in the /etc/ssh/sshd_config file (by default, it's near the very end of the file). Comment it out (put a # at the beginning of the line) and restart sshd.

SCP has no such configuration, the client scp program simply expects the remote scp executable to be in the user's path. So, just delete the scp binary to disable it. (And then you have to remember to delete it again every time you update your SSH package.)

But, as other people have said, this is not going to stop the users from uploading and downloading files. It just makes it ever-so-slightly more difficult. So, if you're doing this for security reasons, you really need to reconsider.

3
  • 3
    Note also that as of OpenSSH 8.7, the scp program can actually use the SFTP protocol internally (and it's going to become the default mode of operation later). You thus have to disable both protocols to actually stop people from using scp. (It's still pointless when shell access is available.)
    – TooTea
    Oct 20 at 8:41
  • Yes, this is originally for security. Since this seems not practical, we need to find some other solution. Thanks for your comment! Oct 20 at 13:56
  • 3
    @OliverChen: I used to triansfer files in/out with uuencode and copy/paste because it was more convenient than the lousy FTP client I had at the time. You can't win.
    – Joshua
    Oct 20 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.