3 Sep
2015
3 Sep
'15
3:42 p.m.
Hi all,
Hoping to crowdsource your knowledge.
In Ubuntu/Debian, is it possible to set up the www-data user with SSH
access (for development purposes; read/write to the web server document
root) but not "shell access" otherwise?
The SSH will be pub-key only, but I already know how to do such things (to
avoid obvious "do it key only" suggestions).
Kind regards
Murray Crane
3 Sep
3 Sep
3:46 p.m.
On Thu, 2015-09-03 at 16:42 +0100, Murray Crane wrote:
Hi all,
Hoping to crowdsource your knowledge.
In Ubuntu/Debian, is it possible to set up the www-data user with SSH
access (for development purposes; read/write to the web server
document root) but not "shell access" otherwise?
The SSH will be pub-key only, but I already know how to do such
things (to avoid obvious "do it key only" suggestions).
Kind regards
Murray Crane
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
You can limit a key to a
particular command in .ssh/authorized_keys,
like this:
command="my_command /var/www" ssh-rsa <pubkey>
Hope that helps,
M
3:49 p.m.
On Thu, Sep 03, 2015 at 04:42:27PM +0100, Murray Crane wrote:
Hi all,
Hoping to crowdsource your knowledge.
In Ubuntu/Debian, is it possible to set up the www-data user with SSH
access (for development purposes; read/write to the web server document
root) but not "shell access" otherwise?
The SSH will be pub-key only, but I already know how to do such things (to
avoid obvious "do it key only" suggestions).
Kind regards
There's a project called scponly that you can use to set this
up. You set it as the login shell for the account, and it implements
the absolute minimum that a shell needs to do to support scp, without
giving any kind of interactive access.
Hugo.
Murray Crane
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
--
Hugo Mills | I spent most of my money on drink, women and fast
hugo@... carfax.org.uk | cars. The rest I wasted.
http://carfax.org.uk/ |
PGP: E2AB1DE4 | James Hunt
4 Sep
4 Sep
11:25 a.m.
On 03/09/2015 16:49, Hugo Mills wrote:
On Thu, Sep 03, 2015 at 04:42:27PM +0100, Murray Crane
wrote:
Another option would be to allow only SFTP, rather than SCP, which (if
the installed OpenSSH version supports it), wouldn't require any
additional software. Most clients that support SCP also support SFTP
https://serverfault.com/questions/354615/allow-sftp-but-disallow-ssh
Misha
--
Misha Gale
PGP Public Key: 0x6F109D93 http://mishagale.co.uk/pubkey.asc
Hi all,
Hoping to crowdsource your knowledge.
In Ubuntu/Debian, is it possible to set up the www-data user with SSH
access (for development purposes; read/write to the web server document
root) but not "shell access" otherwise?
The SSH will be pub-key only, but I already know how to do such things (to
avoid obvious "do it key only" suggestions).
Kind regards
There's a project called scponly that you can use to set this
up. You set it as the login shell for the account, and it implements
the absolute minimum that a shell needs to do to support scp, without
giving any kind of interactive access.
Hugo. 
12:41 p.m.
On 04/09/15 12:25, Misha Gale wrote:
Another option would be to allow only SFTP, rather
than SCP, which (if
the installed OpenSSH version supports it), wouldn't require any
additional software. Most clients that support SCP also support SFTP
I have used this more than once for this sort of thing :
http://www.pizzashack.org/rssh/
3157
days inactive
3158
days old
4 comments
5 participants
participants (5)
-
bitfolk-users＠latter.org -
Hugo Mills -
Matt Molyneaux -
Misha Gale -
Murray Crane