Koozali.org: home of the SME Server

SFTP and Jailed users

Offline gsimpson

  • *
  • 5
  • +0/-0
SFTP and Jailed users
« on: May 28, 2017, 12:54:51 AM »
Greetings.

I am having some difficulty setting up users so that they do not see the data that other users see.
I am setting up an SFTP server and I have installed the "User Remote Access Panel". I have created a group,
a test user belonging to that group, an ibay with no FTP access, and read/write to the group that was created.

In User Remote Access, I have configured this user to have /bin/bash for Shell access.
I cannot log in without this set, which makes no sense to me.
SUDO access is not enabled.
RSSH+VPN access is enabled (again, makes no sense to me since it wont log in with this)
Now, next confusing thing is the Select Chroot Path (which is always blank, when I modify a user).
I choose the drop down for the ibay that I have created with the folder /files under that.
The Chroot path /home/e-smith/files/ibays/<my ibay>/files is selected here.

After saving these settings and logging on as the created user, I was still sent to his real home folder.
I then changed the home path by using the command usermod <username> -d <path I want to user to see on SFTP login>

Now I come to the part that I cannot "fix" and need help.
I was under the impression that a person could be "jailed" or be forced to see only his data and the folders beneath.
This is not happening for this test user. This person can cd to /. I want this user to be jailed and not see anything
other than a folder and sub folders that I specify.

Any help on this would be greatly appreciated,
Greg

Offline Jean-Philippe Pialasse

  • *
  • 2,813
  • +11/-0
  • aka Unnilennium
    • http://smeserver.pialasse.com
Re: SFTP and Jailed users
« Reply #1 on: May 28, 2017, 01:25:03 AM »
From what i read you did pretty well.

Only limit here is that for this to work all parents directories up to your ibay should be chown root:root

Unfortunatly in the way you have /home/e-smith owned by admin

If you do chown root:root /home/e-smith all should work.
You will need a cron task to do this regularly as updates will revert this.
Also the only difficulty i saw with that is using procmail log files can not be created for admin

guest22

Re: SFTP and Jailed users
« Reply #2 on: May 28, 2017, 11:37:45 AM »
Greetings.
Welcome Greg.

Maybe this contrib will help you instead of changing rights on OS level https://wiki.contribs.org/Remoteuseraccess

HTH

Offline Jean-Philippe Pialasse

  • *
  • 2,813
  • +11/-0
  • aka Unnilennium
    • http://smeserver.pialasse.com
Re: SFTP and Jailed users
« Reply #3 on: May 28, 2017, 01:51:38 PM »
Welcome Greg.

Maybe this contrib will help you instead of changing rights on OS level https://wiki.contribs.org/Remoteuseraccess

HTH

As Greg did explained he tried the contrib.
This contrib only allow chroot for regular ftp non encrypted with non encrypted password exchange over the internet, which is unsecure and should be avoided at any cost
. It was developped before the available version of openssh was compiled with chroot option for centos.

When all is correctly configured you could move the user shell to sftp.  You will also need a custom template to lock the group to the ibay. The contribs is no use for that.


See https://bugs.contribs.org/show_bug.cgi?id=3178 for full description of the issue.