Re: sftp - controlling what commands can be executed

[Tim Bronski <tim.bronski@xxxxxxxxx>]

If anyone's interested we have an sftp/ftps server product that DOES 
understand NAMEFMT, library/file/save file structures as well as IFS and 
CCSIDs. You can create virtual environments and directory structures 
using virtual user ids as well as real user profiles. It also allows you 
to use any exit point apis you currently have setup for your FTP.  Even 
though NAMEFMT isn't an sftp command there are ways you can pass 
commands to the server using special listing formats.

On 4/22/2019 1:28 PM, Rob Berendt wrote:
> For this we use GoAnywhere
> The only drawback is that I would not run it on any endpoint lpar where you are running PTC Implementer.  They do not play well together.  GoAnywhere assumes that you are in the IFS and changes all FTP, sftp, etc to start there (NAMEFMT 1).  While PTC Implementer assumes NAMEFMT 0.  GoAnywhere does not recognize the namefmt command so you can't change back to namefmt 0.  Even if they did, Implementer would not issue it as it is an undocumented system requirement.  Thought about trying to set up a separate IP address just for Implementer and see if I could get the IBM supplied FTP server to bind only to that address but decided to forego that and just stop using Implementer on that lpar.
>
> But GoAnywhere is working fine for us and, with our migration to O365 and much smaller attachment restrictions I'm getting quite adept to spinning up new connections.
>
> -----Original Message-----
> From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of tim
> Sent: Friday, April 19, 2019 5:32 PM
> To: midrange-l@xxxxxxxxxxxxxxxxxx
> Subject: sftp - controlling what commands can be executed
>
> We have been using secftp for years. love the interface and the ability to use exit programs to control what a ftp user can do.
>
> Our clients are now asking to use SFTP rather then FTP. It looks like the iseries uses OPENSSH for this process. I did research on how to "restrict" user commands and have tried to modify file /qopensys/QIBM/UserData/SC1/OpenSSH/etc/sshd_config  with the following, but did not work.
>
> Match User xyz
> ChrootDirectory /sftp/xyz
> X11Forwarding no
> AllowTcpForwarding no
> ForceCommand internal-sftp
>
> Is there a way of restricting a SFTP session from certain commands like CD,LS, etc?