RE: (SUMMARY): anonymous sftp?

Hello Wes,

On Tue, 20 May 2003, wjnorth wrote:
> Date: Tue, 20 May 2003 11:49:25 -0700
> From: wjnorth <wjnorth@earthlink.net>
> Subject: RE: (SUMMARY): anonymous sftp?
>
> Is this the only restricted SFTP site you were given? Are the commercial
> versions that offer SFTP restriction as well?

First, I've yet to implement any "anonymous" sftp. I have tried a stock Openssh 3.6.1pX using /bin/false as the shell for the user. THAT does not work :)

Everyone, please jump in here if I say something stupid, misleading or leave something out. Thanks in advance.

Here's what I know from my research. If you want to do sftp/scp ONLY then you have two options: 1) Openssh with rssh, you set rssh as the users shell. 2) SSH.com, their server seems to have this functionality built-in.

To do anonymous sftp with Openssh you would have to create an account that uses password auth and has a null password and of course uses rssh as the shell. I ASSUME you would do something similar (except the rssh) with SSH.com's software. Now an account with a null password should make anyone think twice! It makes me nervous.

Also, no one mentioned SSH.com. in any of the replies to my orig post. I found the reference to sftp only accounts in one of their docs. I assume their package still supports his functionality.

Anyway, hope this helps,
odk

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

>
> I'm working on a program that is in real need of something like this.
>
> -Wes
>

> -----Original Message-----
> From: Oscar Knight [mailto:knightod@appstate.edu]
> Sent: Wednesday, May 14, 2003 11:44 AM
> To: secureshell@securityfocus.com
> Subject: (SUMMARY): anonymous sftp?
>
>
> Hello Everyone,

--
Oscar D. Knight                                     knightod@appstate.edu
Network Support Services                              Voice: 828-262-6946
Appalachian State University, Boone, NC 28608           FAX: 828-262-2236