Re: Solaris 9 sftp-server

Quoting BAUMLER Julie L <[email protected]>:

> We're using Sun's ssh sftp server on Solaris 9 for some (internal) customer
> file tranfers.  But, we don't want to allow these people to login or run
> commands with ssh.  The usual methods to restrict login (/bin/false, "exit"
> in shell profile files, ...) block both or don't work.  We need to be able
> to track file reads and writes, so we need the BSM support of the Solaris
> version of ssh.  Has anyone else run across this?


You can use RBAC to help with this.  They can still login, but they won't be
able to do anything other than logoff :).  My example below is for an account
called mirror, with a profile called Mirror.

First, you need to diasble the default behavior of RBAC to allow standard Unix
priveleges.  Do this by commenting out the following lines in
/etc/security/policy.conf:

  #AUTHS_GRANTED=solaris.device.cdrw
  #PROFS_GRANTED=Basic Solaris User

Next, add some information to /etc/security/prof_attr to define the profile:
  Mirror:::Mirror:help=Mirror.html

Next, set up the commands that the profile can run by adding the following to
/etc/security/exec_attr:
  Mirror:suser:cmd:::/usr/bin/scp:uid=103
  Mirror:suser:cmd:::/usr/lib/ssh/sftp-server:uid=103

Next, add the following to associate the mirror account with the Mirror profile
to /etc/user_attr:
  mirror::::type=normal;profiles=Mirror

Finally, set up the mirror account in the /etc/passwd, /etc/shadow, /etc/group,
etc, but make sure that the default shell is one of the profile shells
(/usr/bin/pfsh, /usr/bin/pfcsh, or /usr/bin/pfksh).

Yes, this does effect the default priveleges for an RBAC setup, but it's not
that difficult to add the "uninherited" priveleged to another profile.

Norman