restrict file transfer in rsync, scp, sftp?

[Jochen Bern]

On 12.11.23 01:08, Bob Proulx wrote:
> Currently rsync and old scp has been restricted using a restricted
> shell configuration.  But of course that does not limit sftp.  And of
> course sftp can be chrooted which [...]  blocks rsync.
[...]
> I hate to have to tell everyone that we can only securely allow one of
> either rsync or sftp but not both.  But at this point I think it must
> be one or the other and either-or seems not possible.

Call me cheap, but I'd try having the sshd listen on a second port and 
put the chroot+sftp config into a "Match LocalPort ..." block.

Yes, that means the users cannot use a single .ssh/config entry for all 
the access modes, but considering that the chroot will change the 
apparently-absolute pathes for SFTP, anyway ...

Kind regards,
-- 
Jochen Bern
Systemingenieur

Binect GmbH
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3449 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20231113/626ebe9c/attachment-0001.p7s>