Re: sftp and utmp

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

 



Franois Ouellet wrote this message on Mon, Apr 03, 2023 at 09:38 -0400:
> Le Friday, 31 March 2023, 17:47:14 EDT John-Mark Gurney a écrit :
> > hvjunk wrote this message on Thu, Mar 30, 2023 at 23:12 +0200:
> > > I've been battling similar issues, and the only methods I've found (with sftp) was to use
> > > software like pureftd or crushftp (using crushftp lately as production) that does handle these
> > > issues "out of the box"
> > > Other than that, I'd expect you'll need to write your own PAM modules to track the accounting part to 
> > > enforce the limits yourself, as you'll need to account for the sftp different from the terminal sessions
> > 
> > You could use an sftp-server wrapper script that creates a lock file/dir
> > or another way to detect if a connection is already present, and then
> > force the use of that script via the sshd_config Subsystem directive.
> 
> I'm using the internal-sftp server, because it's a chrooted setup.  
> Not sure this can easily be done with this setup

You could put the sftp-server program in each chroot, less than ideal,
or or by writing an suid root (always be careful w/ these) helper program
that does the chroot as needed, though it looks like the former is still
needed for the suid solution.

> > > > On 30 Mar 2023, at 22:43, François Ouellet <franco@xxxxxxxxxxxx> wrote:
> > > > 
> > > > Hi,
> > > > 
> > > > We need to limit concurrent sftp logins to one per user (because of bad
> > > > client behaviour).  Is there any way to achieve this I have overlooked?
> > > > 
> > > > It seems it could be possible with pam_limits, if sftp sessions were
> > > > recorded in utmp (a guess from what I found googling around).  If I
> > > > configure /etc/security/limits.conf with
> > > > 
> > > >  testuser hard maxlogins 1
> > > > 
> > > > and connect with ssh, and try a second connection with sftp, the sftp
> > > > fails because there is already one session open.  But if I connect with
> > > > sftp and try a second sftp connection, it is allowed.
> > > > 
> > > > Is there some way to have sftp connections recorded in utmp?  I haven't
> > > > found any reference to this.  There are some posts from 10+ years ago
> > > > where others were trying the same thing but there's no reply about how
> > > > to do it.  Would it be possible to add this option?
> > > > 
> > > > We're using ChrootDirectory and ForceCommand internal-sftp, if it makes
> > > > a difference (I've tried without and had the same results).
> > > > 
> > > > Tried this on Debian bookworm's openssh-server (9.2).  The changelog
> > > > from 9.3 does not mention anything related to this.

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev




[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux