sftp

mazza76 · 03-23-2005, 10:02 AM

Hi

Is there a way of hardening sftp as it appears I can navigate to any directory I wish. I have tried to create a chroot sftp session (patching the sftp-server) but it just hangs and there are no obvious error messages.

It seems as though sftp doesn't refer to the underlying directory permissions, unless of course I am doing something stupid.

Any suggestions would be appreciated.

stickman · 03-24-2005, 08:56 AM

If you don't have the need to provide shell access, rssh and scponly are two quick utilities for setting up a chroot'd environment.

mazza76 · 03-24-2005, 10:14 AM

i've already restricted shell access, but when sftp'ing i can still navigate around the filesystem

stickman · 03-24-2005, 12:02 PM

Just for clarification, which type of sftp are you using: FTP over SSL or SSH-based?

NetSnake · 03-24-2005, 09:13 PM

I may have a alternate way to your way:
Make a new shell like this:

#/bin/sh
/usr/sbin/chroot /usr/chroot /bin/bash

Named it as /bin/chrootsh, and make it executable.
Then change his login shell to this new shell which user you want limit his access.
like
cat /etc/passwd
mike:x:129:129::/home/mike:/bin/chrootsh

Ok, don't warry about Mike logined from, local login or ssh login, he will be limited at /usr/chroot directory.

The directory /usr/chroot must have enough binary command, just like other chroot behavior.

NetSnake · 03-24-2005, 09:22 PM

I'm sorry I forgot one thing:
the command /usr/sbin/chroot must set SUID.
Maybe dangerous.

mazza76 · 03-29-2005, 03:34 AM

stickman - I have been trying to get ssh-based sftp to work.
netsnake - I have been unable to get chroot to work with the sftp-server executable. The chroot environment works well with vsftp though.

mazza76 · 03-30-2005, 02:18 AM

re the sftp directory browsing - i was being dense. i had SUID'ed the sftp-server (while I was trying to sort out chrooting the sftp session) and that caused the issue.

I still haven't been able to create a chrootable sftp-server daemon though.....

sigsegv · 04-08-2005, 05:13 PM

As stickman pointed out -- scponly is what you're looking for.