Originally posted by: nevp

This has probably been asked before but I can't find a solution that matches my situation.

I need to have an account with no remote logins and sftp access. I've seen some suggestions about an alternative shell but I'm concerned this won't be a "normal" ksh environment for the application. i.e. oracle users would run the oracle database allowing access via su - oracle. Also the DBA would want to move files to and from another servers as user oracle with sftp. Can this be done, if so how?

running AIX 6.1 with OpenSSH_4.5p1
thanks
#AIX-Forum

Originally posted by: SystemAdmin

We solved this by having a second 'sshd' service running on a different port.

This second instance of sshd was openssh 5.1 (requires at least 4.9 due to new internal-sftp and chroot functionality), using a couple configuration items to achieve this kind of separation:

1) sftp-only accounts are set up with a common, generic subdir like "/somedir" with 0644:root:staff listed as homedir in /etc/passwd, but directory is not ever really used (just keeps 'mkuser' happy)
2) No real password is set; "password = *" in /etc/security/passwd for the user
3) Supplemental sshd_config configured with these values to enforce the behavior:

AuthorizedKeysFile      /sftpdir/sshkeys/%u.authorized_keys PasswordAuthentication no AllowTcpForwarding no X11Forwarding no Subsystem       sftp    internal-sftp ChrootDirectory /sftphomes/%u ForceCommand internal-sftp

4) A subdir under the chroot() matching whatever was listed in step 1), like /sftphomes/%u/somedir so the chroot() call succeeds.

The effect of this is that users can't use the normal sshd on port 22 since they have no real password and no valid authorized keys file, and the secure sshd enforces keys, which are in a directory outside what the user's chroot()'d internal-sftp session can get to.

The openssh5.1 was compiled w/nothing the free tools (gcc, libraries) here on IBMs AIX toolsite. It was under 5.3TL7, so I can't speak to compilation success on AIX6+.

The only configuration item that "make config" chose that didn't work well for us was HAVE_SETPCRED directive. It appears that it was setting both real and effective UIDs to the non-root user, and the subsequent logic in the ssh code would fail since it was being attempted as a non-root user. I commented out the line like:
/* #define HAVE_SETPCRED 1 */
and all works well now.
#AIX-Forum