Command policy for SFTP

[Sabine Ludewig1709156713]

Hi there

I'm running a Netscaler VPX 13 and I need a user who is only allowed to download log filesv ia SFTP

I understand, that I can't limit him on directory level and that's ok.

 

I created a command policy which only allows  (^sftp.*) and he can log on just fine.

But he can also do everything on file level, like renaming, deleting, uploading etc

He is only assigned this policy. Adding the default read-only policy doesn't change anything.

 

Is there a way to limit him to

- log on

- change directory 

- download (get)?

 

Thanks a lot

 

[Felipe Ruiz1709162764]

Hi Sabine!
Did you find a solution?

I have the exact same requirement, only difference is I'd be using SFTP to copy the backup files in /var/ns_sys_backup to an external repository. The command policy I'm using is also different (^sftp-server$) but that still allows any action to any file in any directory.