Step 1: Create a shell script to run as the user’s shell

Create a shell script called /sbin/sftp-only as follows:

#!/bin/sh
 
if [ "$*" != "-c /usr/libexec/sftp-server" ]
then
    echo “Sorry, ssh access not allowed.”
    exit
fi
 
exec /usr/libexec/sftp-server

Step 2: Edit user accounts to use this shell script as user’s shell

Modify user accounts using usermod to set the shell to /sbin/sftp-only so that when user tries to SSH to the server, the shell script will display the “Sorry, ssh access not allowed.” message. And when the user tries to connect to the server via a SFTP client, the shell script will get executed and it will start the SFTP server for the user.

This script runs it in the background and you could make your commands send their output to a log file and still having full control.

Read the code below how to use it.

You can compile it by placing the code into 'shellproxy.c' and then compile it with the following command:

gcc -o shellproxy shellproxy.c

I hope this is something useful for you as it was for me.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#include <stdio .h>
#include <stdlib .h>
#include <string .h>
 
int main(int argc, char *argv[]) {
    char command[1024];
    int t;
 
    if (argc == 1) {
        printf("\nShell Proxy\n");
        printf("By Marius van Witzenburg <http ://mariusvw.com>\n\n");
        printf("You will mostly use this program from PHP or any other\n");
        printf("webscripting language to background run programs\n\n");
        printf("Usage:\n");
        printf("- CLI:\n");
        printf("shellproxy \"<cmd> <arg>\"\n");
        printf("shellproxy \"<cmd> <arg> > redirect.txt\"\n");
        printf("- PHP:\n");
        printf("system('shellproxy \"<cmd> <arg> &\"');\n");
        printf("system('shellproxy \"<cmd> <arg> > redirect.txt\"');\n\n");
    }
 
    command[0] = 0;
 
    for (t = 1; t < argc; t++) {
        strcat(command, argv[t]);
        strcat(command, " ");
    }
 
    fclose(stdin);
    fclose(stdout);
    fclose(stderr);
 
    system(command);
}

It would be nice if you keep my name mentioned into this code if you use it.

Ps. Donations are welcome...

I placed this script in my home directory as vdi2vmdk.sh but you could place it anywere you want.

The code of vdi2vmdk.sh:

1
2
3
4
5
6
7
8
9
10
11
12
13

#!/bin/sh
echo "VDI 2 Raw..."
ri="svi2raw.tmp"
if [ -e "$ri" ] 
then
    echo "" 
    rm $ri  
fi
/Applications/VirtualBox.app/Contents/MacOS/VBoxManage internalcommands converttoraw -format vdi "$1" "$ri"
echo "Raw to VMDK..."
/Applications/Q.app/Contents/MacOS/qemu-img convert -O vmdk "$ri" "$2"
rm "$ri"
echo "DONE!"

If you have any questions, please ask...

Add a user to your system like you normally do with an password and then run the following command:

usermod -s /usr/libexec/sftp-server username

Then change add the following to /etc/shells to make it a valid shell:

echo '/usr/libexec/sftp-server' >> /etc/shells

Now this user can only run the sftp server as shell