Grant access by scp but not for login, how?

[-fun-]

Hi, is it possible to grant access to a FreeNAS share for download and / or upload of files with scp however deny any interactive login? I would like to create a separate user for this.

 

[DrKK]

If the login shell for the user is set to "nologin", I think you achieve what you want. That should be a choice in the user-add menu

 

[-fun-]

Well there is an option "Disable password login" which comes closest but this is not what I need. The guide says: "when checked, disables password logins and authentication to CIFS shares [...]"

There doesn't seem to be an option "nologin" unfortunately.

 

[hugovsky]

There you go. See at the bottom.

 

[-fun-]

Ah, there it is. Thank you!

 

[dlavigne]

There is also a scponly shell available for this purpose: http://doc.freenas.org/9.3/freenas_services.html#scp-only.

 

[-fun-]

Shame on me. In general I do look up things before posting but I missed this one completely. Thanks for pointing me to this!

 

[anodos]

Shame on me. In general I do look up things before posting but I missed this one completely. Thanks for pointing me to this!

If scp / sftp access is going to be a regular thing, I try to grant it through a jail. It helps prevent accidentally escalating privileges.

 

[-fun-]

Meanwhile I tested a little and granting scp access is actually not working as required for me. This seems to expose the complete filesystem. I had something in mind that exposes specific shares only.

I can of course create what I need which a jail. But before I go this way: Is there a suitable plugin available for this?

 

[anodos]

Meanwhile I tested a little and granting scp access is actually not working as required for me. This seems to expose the complete filesystem. I had something in mind that exposes specific shares only.

I can of course create what I need which a jail. But before I go this way: Is there a suitable plugin available for this?

There's no plugin because this is probably the simplest possible use case for a unix file server. All you're doing is adding users, storage, and configuring ssh. Just create a jail.

If you need to really lock things down, you can chroot sftp (ssh file transfer protocol) for the group of users that have access, then only allow them sftp access.