Jailkit - SFTP users can see other user's home dirs
Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Jailkit - SFTP users can see other user's home dirs
Hello all...
I have successfully set up Jailkit, both with FTP and SFTP users. The FTP users are fully contained in their home directories and can't see anything above them, but when I connect with WinSCP as an SFTP user, I can ascend to the "home" directory above the user's home dir and see the names of all other user's home dirs.
While I'm not able to descend into other user's home directories, I'm all but certain that customers won't appreciate their anonymity being compromised by others seeing that they're a customer of ours.
Each user's home directory has 700 perms and the jailed home directory above it has 755. I've tried reducing this to 750 but then SFTP logins fail.
Does anyone have a workaround to this issue besides setting up dedicated jails for each login?
FTP is a dedicated server application. Obviously JailKit modifies its behaviour appropriately.
ASIDE: FTP should no longer be used for authenticated access. Anonymous access is fine, but if used for user access then passwords could be sent across the network in the clear to any snoopers between the user and he machine.
SFTP is completely different, it connects using SSH, and runs a psuedo FTP file transfer session over that encrypted link. Much like SCP can also do file transfers. As such what modifies FTP will generally not modify SFTP behaviour.
It will not 'jailed', unless you can find a more restricted SFTP subsystem program. The subsystem program is declared in /etc/ssh/sshd_config,
and on my system is /usr/libexec/openssh/sftp-server
Thanks for the reply. I am aware of the differences between FTP and SFTP and what the shortcomings in the FTP protocol are. Jailkit doesn't modify the behavior of the FTP server; it provides a different shell to the user once the user is authenticated.
My problem is with the way Jailkit allows user who have been given access to the sftp-subsystem to see the contents of their home directory's parent folder. FTP users in the same jail can't leave their home directory, so I'm trying to understand why SFTP users can. If you or anyone else have any more ideas as to what I can do to limit this behavior, I'd appreciate hearing them.
If you allow sftp access to the system the you should limit access from ssh itself.
Adding the next lines to your /etc/ssh/ssdh_config will limit access
Subsystem sftp internal-sftp #/usr/lib/openssh/sftp-server
Match group yourgrouphere
ChrootDirectory /home/%u
ForceCommand internal-sftp
AllowTcpForwarding no
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.