0

Is there any way from which we can restrict any particular user to delete files/folder having full permissions from WinSCP.

Thanks in advance.

16
  • full permissions in reference to the user or the folder?
    – Nate T
    Jun 23 at 7:05
  • @Nate T user is having full permission on that directory....our requirement is that user will not be able to delete file from that folder from winscp.....on linux server we have set acl for rm command nad its working fine.......but user is able to delete file from winscp....so we want to restrict delete command from winscp...
    – Neha
    Jun 23 at 7:12
  • Do you need to keep Port 22 open? Does this user need to access via SSH for any other reasons, or are other users accessing via SSH?
    – Nate T
    Jun 23 at 7:52
  • 1
    A method: create a directory watcher (there is for instance a python module for this) on the directories you want this. That allows you to disable deleting and also allows you to catch someone removing lines from a file.
    – Rinzwind
    Jun 23 at 8:48
  • 2
    "on linux server we have set acl for rm command" you would probably have better luck setting an appropriate ACL on the directory whose files you want to protect - restrictions on commands are often easily circumvented (ex. the user can't run rm, but can run find -delete) Jun 23 at 11:32
3

Remove the write permissions from files and folders server-side.

Alternatively you can restrict the "delete" operation on the SFTP server. See Restrict SFTP user to run only limited set of commands/action in Linux. And make sure the user has an SFTP access only.

3

I am fairly certain that this can't be done in the way you are hoping (via settings on the winSCP client.) This forum shows evidence of another server administrator with a similar issue. Upon asking, the winSCP site administrator informs him that this is not possible in winSCP, and tells him to focus on the server side.

As the posts suggest, in order to deny this user access, you will need to use server side settings.

One change that is extremely efficient for stopping remote clients from accessing your server (weather via openssh, winscp, or any other SSH client) is to simply close off Port 22. This is the default port for SSH traffic.

EDIT: Still not sure you have given all the relevant info. Going on the info that you have provided so far, if port 22 needs to remain open, you may need to get creative. That said, I am sure a more straight-forward solution could be given if I / we had more context.

Regardless of the method you use to restrict the user's access, you will first need to remove user's sudo privelege. remove with:

gpasswd --delete pbwriters USER

I believe your goal can be achieved server-side by using the chown and chmod commands. You are going to want to set the g= and o= options in after changing the group to which the file belongs. This line should do the trick:

# Replace DIR w/ outermost folder's name
sudo groupadd pbwriters && sudo chown -R :pbwriters DIR && sudo chmod -R 774 DIR

Now, if parentdirectory in the above command is changed to the name of the outermost directory that you want to restrict, then everything inside of that file will only be writable by those in pbwriters group. To give someone write access, you just need to add them to pbwriters group:

# Just as before, replace USER with name of user
sudo usermod -a -G pbwriters USER
1
  • As an afterthought, you can also set their $SHELL to rbash. Along with chroot, this is an invaluable tool for network admins. This would at least limit the files they could access.
    – Nate T
    Jul 6 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.