Jailkit - SFTP users can see other user's home dirs
 

Hello all...

I have successfully set up Jailkit, both with FTP and SFTP users. The FTP users are fully contained in their home directories and can't see anything above them, but when I connect with WinSCP as an SFTP user, I can ascend to the "home" directory above the user's home dir and see the names of all other user's home dirs.

While I'm not able to descend into other user's home directories, I'm all but certain that customers won't appreciate their anonymity being compromised by others seeing that they're a customer of ours.

Each user's home directory has 700 perms and the jailed home directory above it has 755. I've tried reducing this to 750 but then SFTP logins fail.

Does anyone have a workaround to this issue besides setting up dedicated jails for each login?

Thanks,

Dan

FTP is a dedicated server application. Obviously JailKit modifies its behaviour appropriately.

ASIDE: FTP should no longer be used for authenticated access. Anonymous access is fine, but if used for user access then passwords could be sent across the network in the clear to any snoopers between the user and he machine.

SFTP is completely different, it connects using SSH, and runs a psuedo FTP file transfer session over that encrypted link. Much like SCP can also do file transfers. As such what modifies FTP will generally not modify SFTP behaviour.

It will not 'jailed', unless you can find a more restricted SFTP subsystem program. The subsystem program is declared in /etc/ssh/sshd_config,
and on my system is /usr/libexec/openssh/sftp-server

Thanks for the reply. I am aware of the differences between FTP and SFTP and what the shortcomings in the FTP protocol are. Jailkit doesn't modify the behavior of the FTP server; it provides a different shell to the user once the user is authenticated.

My problem is with the way Jailkit allows user who have been given access to the sftp-subsystem to see the contents of their home directory's parent folder. FTP users in the same jail can't leave their home directory, so I'm trying to understand why SFTP users can. If you or anyone else have any more ideas as to what I can do to limit this behavior, I'd appreciate hearing them.

If you allow sftp access to the system the you should limit access from ssh itself.

Adding the next lines to your /etc/ssh/ssdh_config will limit access

Subsystem sftp internal-sftp #/usr/lib/openssh/sftp-server
Match group yourgrouphere
ChrootDirectory /home/%u
ForceCommand internal-sftp
AllowTcpForwarding no

Is there some other alternatives (variation) to the internal-sftp
or other types of ssh subsystems that has been developed.

SSH has been around for a long time and I'm certain someone much have done some projects in this area.