Re: Solaris 9 sftp-server

On Tue, 8 Apr 2003, David M. Fetter wrote:
> SFTP is a subsystem of SSH and therefore in order to use SFTP you must
> also provide SSH login access.  At this time I don't think there is a
> good way around this.  You could use something like restricted ksh
> (rksh) or some other restricted shell to tighten down their login access
> in a way that might make it so only SFTP is feasible to use for them.

Another approach we tested (with OpenSSH, but my guess is it could be adapted)
relies on the fact that authorized_keys/authorized_keys2 optionally designates
what commands you may be able to execute via ssh; in that case, you can tell
sshd that the only command the user is allowed to execute is the scp command;
even better, with a slight wrapper you can actually control the exact syntax
of the scp command you're allowing to run, which means the user can't use scp
to replace the authorized_keys file :).  It's pretty sweet, IMHO.

-roy