Originally posted by: hkrvdhk

Hi all,

I can set a value to the "AllowFiles" in the SSH (sshd_config) to restrict a particular directory can be accessed by users. However, I found that I cannot set this variable to multiple values. For example, I want to set the user "test01" only allowed to access "/tmp/test01", and user "test02" only allowed to access "/app/data". I set as follows but all failed:

Allowfiles "test01:/tmp/test01" "test02:/app/data"
Or
Allowfiles "test01,test02:/tmp/test01,/app/data"
Does this mean that the "AllowFiles" can only be set to one value?

Thanks,
John
#AIX-Forum

Originally posted by: teletype

Maybe you could use a match rule. Something like:
Match user test01
Allowfiles /tmp/test01
Match user test02
Allowfile /tmp/test02

I didn't know the Allowfiles option in sshd. So I am not shure if this is the correct syntax.
#AIX-Forum

Originally posted by: hkrvdhk

Hi,

Thanks.

However, it seems that it cannot work.

I even tried to add two lines of AllowFiles, e.g.:

Allowfiles "test01:/tmp/test01"
Allowfiles "test02:/tmp/test02"

After restarting the SSH, I found that the first statement (i.e. test01) cannot work, and only the second statement is working. The final result is only user "test02" can now access the files, but user "test01" cannot access the files at /tmp/test01.

Anyone knows the solution?

Thanks
#AIX-Forum

Originally posted by: teletype

Mmm.. Did you use identation in your sshd_config file while trying the match user construction? I thought that mattered for the match construction. I couldn't get tabs in my previous reply (someone enlighten me). I hope you didn't copy my typos :-)
So in the config file it should read:
Match user test01
<tab>Allowfiles "test01:/tmp/test01"
Match user test02
<tab>Allowfiles "test02:/tmp/test02"

Hope this helps
#AIX-Forum

Originally posted by: hkrvdhk

Hi,

Thanks. However, the SSH still cannot be started after using the AllowFiles under the "Match user" (with tab). I doubted whether the AllowFiles can be used with the "Match user".

Any suggestions?

Thanks.
#AIX-Forum

Originally posted by: SystemAdmin

A plan B you could create corresponding groups for this users and grant access only for the following groups thats bellongs to the users (test01 anda test02).

You just adjust the permissions using chmod command and enjoy
#AIX-Forum