SFTP with dummy shells

[Florin Andrei]

On Sat, 2002-02-23 at 23:38, Ben Lindstrom wrote:
> 
> I don't like that idea.. When I set a shell to /bin/false I expect
> all deamons to honor that shell.  And not to go behind my back and
> execute some random command for the user.. Be it rsh, ssh, telnet, etc.

Well, the thing i would like to do is to provide SFTP to some users,
deny /bin/sh to them, while still being able to provide SSH for some
other users.
If SFTP would have been the only requirement, that would be simple:
install an FTP daemon that provides SFTP. But i need both SFTP and SSH,
and the access is not uniform for all users: some of them should have
/bin/sh (so they do SFTP and full shell), some other /bin/false (so they
do only SFTP) and some other should have a /usr/bin/dialog wrapper of
some sort (they do SFTP and run just a restricted wrapper in the shell).
A reasonable and elegant solution for this is to have the entire SFTP
subsystem shell-independent.

> I don't think it is really the subsystem's job.  Any correctly written
> dummy shell can detect a '-c sftp-server' and hanlde it gracefully
> (and no /bin/false is not a dummy shell, IMNSHO =).

Hmmm... Actually, that sounds interesting. :-)
So, "-c sftp-server" is the only command passed to the shell?

-- 
Florin Andrei

"When the prime minister is appearing at product launches by a company
twice found by courts to be abusing a monopoly and facing billions of
dollars in lawsuits, you have to ask questions." - Alan Cox