Skip to content

Instantly share code, notes, and snippets.

@tuxfight3r
Created February 8, 2016 14:38
Show Gist options
  • Save tuxfight3r/4ea57fe56365fbec7cf6 to your computer and use it in GitHub Desktop.
Save tuxfight3r/4ea57fe56365fbec7cf6 to your computer and use it in GitHub Desktop.
openssh - disable scp and log all sftp connections
#Disable scp and logs all sftp connections
#Disable Scp
mv /usr/local/bin/scp{,out}
#Create fake scp message
cat > /usr/local/bin/scp <<EOF
#!/bin/bash
echo "This service allows ssh/sftp connections only"
EOF
#Create a wrapper script
cat > /usr/local/bin/sftp-wrapper<<EOF
#!/bin/sh
#
# sftpd wrapper script for executing pre/post session actions
#
# pre session actions and logging here
SOURCE_IP=\${SSH_CLIENT%% *}
MSG_SESSION_START="user \$LOGNAME session start from \$SOURCE_IP"
logger -p local5.notice -t sftpd-wrapper -i "\$MSG_SESSION_START"
# start actual SFTP session
/usr/libexec/openssh/sftp-server -f LOCAL5 -l VERBOSE
# add post session actions here
MSG_SESSION_STOP="user \$LOGNAME session ended from \$SOURCE_IP"
logger -p local5.notice -t sftpd-wrapper -i "\$MSG_SESSION_STOP"
EOF
#Add Subsystem
vi /etc/ssh/sshd_config
#Comment all subsystem and add the below line
Subsystem sftp /usr/local/bin/sftp-wrapper
###Enable logging
vi /etc/rsyslog.conf
#log all sftp transactions with output file sync
local5.* -/var/log/sftp.log
#create sftp.log file
touch /var/log/sftp.log
#Restart services
service sshd restart
service rsyslog restart
@p3rtinax
Copy link

p3rtinax commented Nov 27, 2018

can you please help me with this script?
is it one time config only or it has to be run at startup everytime?
where section #Create a wrapper script, ends ?
is it possible to block sftp, and allow SSH only?
is it working on ubuntu 14 and 16?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment