PowerShell
Disable shell access while allowing SCP
I have an OpenSSH Server on Windows that I want to use only for SCP. Is there a way to disable normal SSH (shell) access while still allowing SCP?
If your user authenticates via public-key, you can control the command that gets executed instead of the shell with the command attribute in front of the key in authorized_keys. This is commonly used e.g. as in
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="scp -v -r -d -t ~/CONTENT" ssh-rsa AAAAMYRSAKEY...
See this answer for details.
I'm not sure how to achieve the same for other authentication mechanisms, e.g. GSSAPI or password, where there are no corresponding entries in an (equivalent of) the authorized_keys file. May be this can be done via the ForceCommand option in sshd_config, perhaps after a Match on the user name?
According to the OpenSSH Server Configuration for Windows 10 1809 and Server 2019 documentation, you can achieve this using ForceCommand internal-sftp in sshd_config.
See also sshd_config wiki page and #1148.
From my testing, that command would force SFTP while disallowing SSH and SCP.
I need a way to disallow SSH (i.e. shell access) while allowing SCP (and optionally, SFTP).
The way scp host:file . works is that it just runs ssh host 'scp -f file' to start an scp -f file process on the other side for a download, or an ssh -t file process for an upload, and then uses stdin/stdout to communicate with that peer process to transfer the file. So unlike SFTP, SCP does not use any file-transfer protocol built into sshd, but instead calls another process at the other end to handle the transfer, just like rsync, svn, git, and many other programs that tunnel a protocol over ssh interactive sessions do. So if you want to allow SCP to work, you'd really need a replacement shell that doesn't allow the user to execute anything other than scp -f or scp -t at the other end. I don't know of a ready-to-use solution that doesn't involve writing such a tiny dummy shell to filter these permitted command lines.
GNU Rush appears to be a sophisticated restricted shell to allow only a limited set of commands, such as scp to be executed by an ssh user. sshdo appears to be another one. I don't know if there is any Windows port available yet of either.
I would probably simply write a little Perl or Python script to achieve the same thing, i.e. check the command received from sshd and execute it if it matches an allowed pattern.
As suggested above, I've handled this with a compiled python script using the ForceCommand in sshd_config. My code is available here:
https://github.com/flakshack/internal-scp
Basically, I just take the SSH_ORIGINAL_COMMAND, replace the "SCP" part with the full path to the Windows SCP.EXE file and pass the rest as an argument, hopefully avoiding shell injection issues. It works fine for my use case (simple config export from a network device that only supports SCP not SFTP). As usual, YMMV and my suggestion is that you don't risk your company on my dumb code.
