Difference between revisions of "SFTP chroot"

From ArchWiki
Jump to: navigation, search
m (TCP Forwarding should normally not be allowed for group "sftpusers" (SECURITY))
(Added notes about ownership/permissions that sshd requires to allow the chroot)
Line 51: Line 51:
  
 
  sshd: ALL
 
  sshd: ALL
 +
 +
sshd will also reject sftp connections to accounts that are set to chroot into any directory that has ownership/permissions that sshd doesn't consider secure. sshd apparently has some strict ownership/permission requirements because every directory in the chroot path must be owned by root and only writable for the owner. So, for example, if the chroot environment is in a user's home directory both /home and /home/username must be owned by root (group ownership doesn't seem to matter) and permissions along the lines of 700 or 755 (775 won't work for example since it's group writable).
  
  
 
= Links & References =
 
= Links & References =
 
*[http://www.minstrel.org.uk/papers/sftp/ http://www.minstrel.org.uk/papers/sftp/builtin/]
 
*[http://www.minstrel.org.uk/papers/sftp/ http://www.minstrel.org.uk/papers/sftp/builtin/]

Revision as of 10:25, 18 December 2009


Introduction

OpenSSH 4.9+ includes a built-in chroot for sftp, but requires a few tweaks to the normal install.

Installation

This package is available in the core repository. To install it, run

# pacman -S openssh

Configuration

In /etc/ssh/sshd_config, modify the Subsystem line for sftp:

 Subsystem       sftp    internal-sftp

At the end of the file, add something similar to the following for a group:

 Match Group sftpusers
   ChrootDirectory %h
   ForceCommand internal-sftp
   AllowTcpForwarding no

Or for a user:

 Match User username
   ChrootDirectory %h
   ForceCommand internal-sftp

The %h represents the users home directory.

Restart sshd:

# /etc/rc.d/sshd restart

Adding new chrooted users

If using the group method above, ensure all sftp users are put in the appropriate group, i.e.:

 usermod -g sftpusers

Also, set their shell to /bin/false to prevent a normal ssh login:

 usermod -s /bin/false

Note that since this is only for sftp, a proper chroot environment with a shell and /dev/* doesn't need to be created.

Their chroot will be the same as their home directory. The permissions are not the same as a normal home, though. Their home directory must be owned as root and not writable by another user or group. This includes the path leading to the directory. My recommendation is to use /usr/local/chroot as a root and build the home directories under that.

Testing your chroot

# ssh username@localhost

should refuse the connection or fail on login. The response varies, possibly due to the version of OpenSSH used.

# sftp username@localhost

should place you in the chroot'd environment. If not, ensure that your /etc/hosts.allow file contains the following line or one similar to allow ssh connections:

sshd: ALL

sshd will also reject sftp connections to accounts that are set to chroot into any directory that has ownership/permissions that sshd doesn't consider secure. sshd apparently has some strict ownership/permission requirements because every directory in the chroot path must be owned by root and only writable for the owner. So, for example, if the chroot environment is in a user's home directory both /home and /home/username must be owned by root (group ownership doesn't seem to matter) and permissions along the lines of 700 or 755 (775 won't work for example since it's group writable).


Links & References