1

On a CentOS 7 server, I'd like to configure it such that:

  1. It accepts SSH connections, like PuTTY
  2. It denies SCP/SFTP connections, like SCP, WinSCP, and FileZilla

Is such a configuration possible?

Improve this question
4
  • 1
    See possible solutions and other detail on the topic here: serverfault.com/questions/28858/…
    – Vomit IT - Chunky Mess Style
    Oct 19, 2021 at 13:47
  • 31
    It does not make sense. If you allow a shell access, the user can do anything with the system. Disabling scp/sftp does not prevent the user from uploading/downloading files/data. It just makes it less convenient.
    – Martin Prikryl
    Oct 19, 2021 at 13:49
  • 13
    This reads like an XY problem. You have indicated that you have a security problem (which you have not expressed) and you have asked for what you believe is the solution to this problem. Instead, perhaps ask a new Question where you state the security problem and obtain Answers that don't assume the solution you write about here as the starting point...
    – Eric Towers
    Oct 20, 2021 at 18:27
  • If you give people shell access, they're going to be able to create files directly, as in simply echo my stuff>> newfile.sh.
    – Nelson
    Oct 21, 2021 at 10:14

2 Answers 2

Reset to default
35

It wouldn't help you because the user could trivially do:

ssh user@host "cat /path/to/file" > /local/path/to/file
cat /local/path/to/file | ssh user@host "cat - > /path/to/file"

to copy files down and up respectively.

Improve this answer
2
5

Yes, you can.

To disable sftp, find the line that starts with Subsystem sftp in the /etc/ssh/sshd_config file (by default, it's near the very end of the file). Comment it out (put a # at the beginning of the line) and restart sshd.

SCP has no such configuration, the client scp program simply expects the remote scp executable to be in the user's path. So, just delete the scp binary to disable it. (And then you have to remember to delete it again every time you update your SSH package.)

But, as other people have said, this is not going to stop the users from uploading and downloading files. It just makes it ever-so-slightly more difficult. So, if you're doing this for security reasons, you really need to reconsider.

Improve this answer
3
  • 3
    Note also that as of OpenSSH 8.7, the scp program can actually use the SFTP protocol internally (and it's going to become the default mode of operation later). You thus have to disable both protocols to actually stop people from using scp. (It's still pointless when shell access is available.)
    – TooTea
    Oct 20, 2021 at 8:41
  • Yes, this is originally for security. Since this seems not practical, we need to find some other solution. Thanks for your comment!
    – Oliver Chen
    Oct 20, 2021 at 13:56
  • 3
    @OliverChen: I used to triansfer files in/out with uuencode and copy/paste because it was more convenient than the lousy FTP client I had at the time. You can't win.
    – Joshua
    Oct 20, 2021 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .