blocks|key|2264356|text|从4.9版OpenSSH开始(在Centos5.x中不可用，但ChrootDirectory特性已被支持)有一个internal-sftp子系统：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2264357|Subsystem+sftp+internal-sftp|code-block|syntax|javascript|2264358|然后阻止其他用途：|2264359|Match+group+sftponly
+++++ChrootDirectory+/upload/%25u
+++++X11Forwarding+no
+++++AllowTcpForwarding+no
+++++AllowAgentForwarding+no
+++++ForceCommand+internal-sftp|2264360|将用户添加到sftponly组。chroot目录必须由root用户拥有，并且不能分组可写，因此为每个用户创建一个子目录，例如由适当用户拥有的uploads或home/$username+(如果您与他们的主目录匹配，它将是连接时的默认工作目录)。我还将/bin/false设置为用户的shell。|2264361|例如，用户可以通过以下方式上传单个文件：|2264362|sftp+username@hostname+<<<+'put+filename.ext+uploads/'|2264363|(scp有望很快被修改为使用sftp，因此这将变得更容易)|entityMap^0|1K|D|0|0|0|0|6|8|1Y|7|26|E|3H|A|0|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@$9|Y|A|Z|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|10|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|11|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|12|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|13|8|@$9|14|A|15|B|C]|$9|16|A|17|B|C]|$9|18|A|19|B|C]|$9|1A|A|1B|B|C]]|D|@]|E|$]]|$1|Q|3|R|5|6|7|1C|8|@]|D|@]|E|$]]|$1|S|3|T|5|H|7|1D|8|@]|D|@]|E|$I|J]]|$1|U|3|V|5|6|7|1E|8|@]|D|@]|E|$]]]|W|$]]

Starting with version 4.9 OpenSSH (not available in centos 5.x but ChrootDirectory feature was backported) has an <code>internal-sftp</code> subsystem:
<pre><code>Subsystem sftp internal-sftp
</code></pre>
And then block other uses:
<pre><code>Match group sftponly
 ChrootDirectory /upload/%u
 X11Forwarding no
 AllowTcpForwarding no
 AllowAgentForwarding no
 ForceCommand internal-sftp
</code></pre>
Add your users to the <code>sftponly</code> group. The chroot directory must be owned by root, and cannot be group-writeable, so create a subdirectory for each user, e.g. <code>uploads</code> or <code>home/$username</code> that's owned by the appropriate user (if you match their home directory, it will be the default working directory when connecting). I'd also set <code>/bin/false</code> as the user's shell.
As an example, users can then upload single files with:
<pre><code>sftp username@hostname &lt;&lt;&lt; 'put filename.ext uploads/'
</code></pre>
(scp will hopefully soon be modified to use sftp so this will become easier)

blocks|key|2264393|text|有一个shell+scponly，这是什么？它也能变色。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/scponly/scponly/wiki^0|9|7|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@$A|L|B|M|1|N]]|C|$]]]|D|$E|$5|F|G|H|C|$I|J]]]]

There is a shell <a href="https://github.com/scponly/scponly/wiki" rel="noreferrer">scponly</a> what does this. It can chroot too.

blocks|key|4556225|text|签出rssh，这是一个允许sftp但拒绝ssh的假shell。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4556226|更多关于RSSH的信息|4556227|http://www.pizzashack.org/rssh/|offset|length|4556228|RPM|4556229|http://pkgs.repoforge.org/rssh/|4556230|您可以将rssh配置为允许/拒绝sft、scp等不同行为。|entityMap|0|LINK|mutability|MUTABLE|url|1^0|0|0|0|V|0|0|0|0|V|1|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|W|8|@]|9|@$F|X|G|Y|1|Z]]|A|$]]|$1|H|3|I|5|6|7|10|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|11|8|@]|9|@$F|12|G|13|1|14]]|A|$]]|$1|L|3|M|5|6|7|15|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|E]]|T|$5|P|Q|R|A|$S|K]]]]

Checkout rssh which is a fake shell that allows sftp but denies ssh

More about RSSH

<a href="http://www.pizzashack.org/rssh/" rel="noreferrer">http://www.pizzashack.org/rssh/</a>

RPMs

<a href="http://pkgs.repoforge.org/rssh/" rel="noreferrer">http://pkgs.repoforge.org/rssh/</a>

You can configure rssh to allow / deny different behaviours like sft, scp etc.

blocks|key|4556302|text|如前所述，我使用了将用户shell指定为/bin/false的方法。但是，必须确保/bin/shell位于/etc/shell中。然后，它运行ssh=no+ftp=ok。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4556303|我还使用vsftpd并添加以下内容|4556304|4556305|chroot_local_user=YES到/etc/vsftpd/vsftpd.conf，这样ftp就不能看到他们自己的日期。|4556306|对于每个用户来说，这些简单的更改对ssh配置并没有什么烦人的配置。|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|L|8|@]|9|@]|A|$]]|$1|E|3|F|5|6|7|M|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

I use the method of specifying the user shell as /bin/false as mentioned. However, you must ensure that /bin/shell is in /etc/shells. Then it works ssh=no ftp=ok.

I also use vsftpd and add this 
chroot_local_user=YES
to 
/etc/vsftpd/vsftpd.conf
so that ftp-ers can't see date other then their own.

Advantage to these simple changes are no annoying config to ssh config for each user.

blocks|key|4556497|text|罗布·沃特斯的解决方案只需要一点点改变..。由于我不能评论缺乏要点，我将在这里重复它是如何为我工作的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4556498|您在sshd_config中选择的目录，确实需要属于根用户，任何其他用户或组都不能写。所以，如果你把|4556499|ChrootDirectory+/上载/%25u|4556500|“%25u”指定的用户目录必须符合相同的规则。如果您不这样做，您将得到“错误的所有权或模式的chroot目录”错误。相反，您只放置基本目录，并将用户拥有的和可写的目录传递给ForceComand。见下文：|4556501|#+override+default+of+no+subsystems
#Subsystem++++++sftp++++/usr/lib/openssh/sftp-server
Subsystem+++++++sftp++++internal-sftp

Match+group+sftponly
+++++ChrootDirectory+/upload
+++++X11Forwarding+no
+++++AllowTcpForwarding+no
+++++AllowAgentForwarding+no
+++++ForceCommand+internal-sftp+-d+/%25u|code-block|syntax|javascript|4556502|现在，当用户登录时，内部sftp将将de+current目录更改为正确的位置。|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|S|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|T|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|U|8|@]|9|@]|A|$]]]|O|$]]

The solution from Rob Wouters need only a minor change... as I could not comment for lack of points, I'll just reproduce here how it worked for me.
The directory you chroot to in sshd_config, really need to belong to root and not writable by any other user or group. So, if you put
ChrootDirectory /upload/%u
the user directory specified by '%u' must comply to the same rule. If you don't, you'll get &quot;bad ownership or modes for chroot directory&quot; error. Instead, you put only the base directory and pass the user owned and writable directory to the ForceComand. See below:
<pre><code># override default of no subsystems
#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

Match group sftponly
 ChrootDirectory /upload
 X11Forwarding no
 AllowTcpForwarding no
 AllowAgentForwarding no
 ForceCommand internal-sftp -d /%u
</code></pre>
Now, when the user logs in, the internal-sftp will change de current directory to the right place.

blocks|key|4556167|text|您可以修改/etc/passwd，并给该用户一个假shell，以便他不能使用ssh。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

You can modify /etc/passwd and give that user a fake shell so that he can not use ssh.

blocks|key|4556336|text|不要忘记找到一行UsePAM+yes并对其进行评论：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4556337|#UsePAM+yes|code-block|syntax|javascript|4556338|在不禁用此功能的情况下，SSH服务器将在重新加载/重新启动时崩溃。因为您不需要PAM的高级功能，所以这很好。|entityMap^0|8|A|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|Q|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|R|8|@]|D|@]|E|$]]]|M|$]]

Don't forget to find the line <code>UsePAM yes</code> and comment it:

<pre><code>#UsePAM yes
</code></pre>

Without disabling this, your SSH server would crash on reloading/restarting. Since you do not need fancy functions of PAM, this is fine.

blocks|key|4556382|text|将ssh配置为只为某些选定用户启用sftp是一个好主意，只要您安装了scponly或rssh，它就能正常工作。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4556383|rssh工作正常，除非您需要配置监狱，在这种情况下，尝试遵循CHROOT手册提供的指令是疯狂的，导致“复制”系统可执行文件的大部分和库就在“每个用户监狱”下面，包括rssh+shell本身。这是一种浪费空间的方法。|4556384|scponly需要对配置有一个深刻的理解，从而导致在监狱设置的情况下始终存在的拒绝登录的问题。|4556385|允许监狱正常工作的"ftp“功能、SSL/TLS对安全事务和登录的支持的简单方法是使用”旧的但工作的“VSFTPD，它安装迅速、干净，并提供所有需要的可配置性，最后但并非最不重要的是:它工作！|4556386|莫里齐奥。|entityMap^0|Y|7|16|4|0|0|4|2A|4|0|0|7|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]|$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|T|8|@$9|U|A|V|B|C]|$9|W|A|X|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|Y|8|@$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|J|3|K|5|6|7|11|8|@]|D|@]|E|$]]|$1|L|3|M|5|6|7|12|8|@]|D|@]|E|$]]]|N|$]]

Configuring ssh to enable only sftp for some selected users is a good idea and it works properly, provided that you you install either <code>scponly</code> or <code>rssh</code>.

<code>rssh</code> works fine, unless you need to configure jail, in this case try to follow instruction provided by CHROOT manuals is crazy, leading to "copy" large parts of system executables and library just below "each user jail", including <code>rssh</code> shell itself.
It is a space-wasting method.

<code>scponly</code> needs a deep understanding in configuration leading to ever-present problem of login rejection in case of jail setup.

The straightforward way to allow "ftp" functionalities with jail properly working, SSL/TLS support for secure transactions and login is to use an "old-but-working" VSFTPD, which installs quickly and cleanly and offers all configurability as needed and, last but not least: it works!

Maurizio.

I'm starting a very little hosting company for a few friends and little clients, nothing big.

I want to give my "clients" the right to manage their files on the server. I hate FTP as it is not secure and it's in my opinion obsolete.

So I'd like to allow my users to connect through SFTP but not allow them to connect through SSH. (I know, I know, SFTP is using SSH). But I was just wondering, is it possible?

So I wouldn't have to install a FTP service on the server and everything would be awesome!

Allow SFTP but disallow SSH?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

我正在为几个朋友和小客户开办一家小型托管公司，没什么大不了的。我想给我的“客户端”在服务器上管理他们的文件的权利。我讨厌FTP，因为它不安全，而且在我看来已经过时了。因此，我希望允许我的用户通过SFTP进行连接，但不允许他们通过SSH进行连接。(我知道，我知道，SFTP正在使用SSH)。但我只是在想，这有可能吗？这样我就不用在服务器上安装FTP服务了，一切都会很棒！

问允许SFTP但不允许SSH？
EN

回答 8

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问允许SFTP但不允许SSH？EN

回答 8

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问允许SFTP但不允许SSH？
EN