RE: sftp - controlling what commands can be executed

For this we use GoAnywhere.
The only drawback is that I would not run it on any endpoint lpar where you are running PTC Implementer. They do not play well together. GoAnywhere assumes that you are in the IFS and changes all FTP, sftp, etc to start there (NAMEFMT 1). While PTC Implementer assumes NAMEFMT 0. GoAnywhere does not recognize the namefmt command so you can't change back to namefmt 0. Even if they did, Implementer would not issue it as it is an undocumented system requirement. Thought about trying to set up a separate IP address just for Implementer and see if I could get the IBM supplied FTP server to bind only to that address but decided to forego that and just stop using Implementer on that lpar.

But GoAnywhere is working fine for us and, with our migration to O365 and much smaller attachment restrictions I'm getting quite adept to spinning up new connections.

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of tim
Sent: Friday, April 19, 2019 5:32 PM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: sftp - controlling what commands can be executed

We have been using secftp for years. love the interface and the ability to use exit programs to control what a ftp user can do.

Our clients are now asking to use SFTP rather then FTP. It looks like the iseries uses OPENSSH for this process. I did research on how to "restrict" user commands and have tried to modify file /qopensys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config  with the following, but did not work.

Match User xyz
ChrootDirectory /sftp/xyz
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

Is there a way of restricting a SFTP session from certain commands like CD,LS, etc?