Hey, So, I would be looking at type A. Forgive me if my understanding of how OpenSSH operates is not reflective of reality. I am assuming that, the file transfer is happening somewhat logically, with a name being known, content written, blah blah. >From reading scp.c, it appears that, the client end at least knows the file name so I must assume the server end must be given it. I am hoping to filter on that file name so I can reject certain files (ideally, configurable file patterns). Suppose I wish for all files named "kitten.txt" to be rejected, I would simply compare the incoming file name to that and, if a match, end the transfer and session. Not using any third party apps, nor will I propose any - I wish to make sshd/scp dance this dance, if I can. Note that, if it's actually impossible to do this, that's an acceptable outcome. Not preferred - I hate giving up - but, an uncomfortable answer is still an answer. Cheers! Jon ________________________________ From: openssh-unix-dev <openssh-unix-dev-bounces+earlej=hotmail.com@xxxxxxxxxxx> on behalf of Morham Anthelleron <opensshdev@xxxxxxxxxxx> Sent: Thursday, August 3, 2017 7:33:30 PM To: openssh-unix-dev@xxxxxxxxxxx Subject: Re: Filter files received on scp server Quoting Jon Earle <earlej@xxxxxxxxxxx>: > Hey folks, > > > For reasons, I am trying to restrict what files the scp server will accept. Are you trying to filter based on filenames or as a completion task upon successful receipt of the accepted files through ClamAV or similar scanning tool. (Let's call the first example "Type A" and the second "Type B".) Or alternatively, you could just use "file magic" detection of *ANY* system executable, for a much lighter weight "threat scanning". Let's call that Type C (or B-Light). With Type B (and probably C), I'm assuming you'd quarantine the file(s) in transit until the scanning is complete, with a successful result "releasing" the file to its proper location, while a "failed" file would be deleted or quarantined with log entries to describe the situation. This sounds like a much "heavier" change to make to sshd than Type A, even if it is the more effective strategy. You're patching the code on the server and/or running the server's sshd with the appropriate debug/logging settings, correct? =M= _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
