[Q] create account which can only transfer file use SSH????

[Ian Mortimer]

On Sat, 2005-01-08 at 02:17, mcclnx mcc wrote:
> We have Redhat AS 2.1 nad 3.0 installed on servers. 
> Due to security reason, we disable FTP and TELNET. 
> Server onlly support SSH.  
> 
> We plan to create a account which can ONLY login and
> transfer data use scp or winscp on PC site (similiar
> to FTP function).
> 
> Any one know how to set it up on Redhat?

One way to do this is to generate a key pair (ssh-keygen) for
the user and add the public key to the .ssh/authorized_keys file 
with a forced command.  Something like:

   command="scp -t _directory_" ssh-rsa AAAA...

(replace _directory_ with the actual path).

Using the private key they'll be able to scp files to the specified
directory but not login.  For security you could protect the private 
key with a passphrase (*) and restrict the keys use to a specific host
or domain:

   from="host.domain.net",command=....

(*) This is more difficult if the scp is automated.


Another way would be to give the user a shell which only allows
them to use scp.


-- 
Ian