From owner-freebsd-questions@FreeBSD.ORG Thu Feb 17 09:54:00 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F101616A4CE for ; Thu, 17 Feb 2005 09:54:00 +0000 (GMT) Received: from hobbes.brasapen.org (tafkam.xs4all.nl [82.92.76.34]) by mx1.FreeBSD.org (Postfix) with ESMTP id E7A6F43D5D for ; Thu, 17 Feb 2005 09:53:59 +0000 (GMT) (envelope-from tafkam@brasapen.org) Received: from webmail.home.brasapen.org (www.bos-zuidema.nl [172.20.1.10]) by hobbes.brasapen.org (Postfix) with ESMTP id AC4A960C8; Thu, 17 Feb 2005 10:53:55 +0100 (CET) Received: by webmail.home.brasapen.org (Postfix, from userid 1001) id 9767E6101; Thu, 17 Feb 2005 10:53:55 +0100 (CET) Date: Thu, 17 Feb 2005 10:53:55 +0100 From: Eilko Bos To: ???????????? ?????? Message-ID: <20050217095355.GB16854@webmail.home.brasapen.org> References: <111442689.20050217114211@mosline.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <111442689.20050217114211@mosline.ru> User-Agent: Mutt/1.4.2.1i X-Bos-Zuidema-MailScanner-Information: Neem contact op met postmaster@bos-zuidema.nl voor meer informatie X-Bos-Zuidema-MailScanner: Found to be clean X-MailScanner-From: tafkam@brasapen.org cc: freebsd-questions@freebsd.org Subject: Re: login permission over scp X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Feb 2005 09:54:01 -0000 Hi, >From the keyboard of ???????????? ??????, written on Thu, Feb 17, 2005 at 11:42:11AM +0300: > i need only secure copy, but must give full user shell to user user1@A > on host B. if attaker take control of A, he can shell to user@b > > setting /sbin/nologin to shell user@B- scp not work > > what can i do to reduce permission user@b You can use rssh from the ports: $ cat /usr/ports/shells/rssh/pkg-descr rssh is a Restricted Secure SHell that allow only the use of sftp or scp. It could be use when you need an account (and a valid shell) in order to execute sftp or scp but when you don't want to give the possibility to log in to this user. WWW: http://www.pizzashack.org/rssh/index.shtml - enigmatyc enigmatyc@laposte.net $ Grtz, -- Eilko.