[GUIDE] SFTP Selective remote folder access to certain users

1. offizieller Beitrag

    Hi subzero79,


    thanks for the guide, very interesting!


    One remark: in the section "is important that this two folders are owned by root and no one else has write access" line 1 should read "chown root:root /sftp/{user1,user2}", shouldn't it?


    Regards

    OMV 2.x - Kralizec // Hardware: HP Microserver N54L, 4GB RAM, 2x3TB WD Red - RAID 1, Sandisk SSD 60GB for system

    Gefällt mir 1

    Does this still work? I have been using a similar setup for quite some time on OMV and it stopped working recently. It throws this error when logging in:


    Write failed: Broken pipe
    Couldn't read packet: Connection reset by peer


    I have double checked the ownership and permissions on the folders.

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    Einmal editiert, zuletzt von gderf ()

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    Einmal editiert, zuletzt von WastlJ ()

    Permissions, ownerships, and all that are correct. I didn't change anything here. The last time it worked (and was logged) was Dec 26, 2015. There may have been some updates since then, but I don't track them.


    I'll do a quick fresh install to spare media and try to get this working there, the do any updates and see if it breaks.

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    It's correct, as I said I made no changes.


    I have installed fresh to spare media on another box and configured the absolute minimum needed to chroot that user and it works. The sshd_config files are identical. Something else is broken. SFTP works, but not if chroot'd.

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    root@omv:~# tree /sftp -L 2 -dupg
    /sftp
    `-- [drwxr-xr-x root root ] hork


    1 directory
    root@omv:~#

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    As I said in my OP, I used other methods to set this up on this box and on all my debian machines. More streamlined and can be done entirely from CLI. On this box it has been working fine since the original install last June.


    This user belongs to a group with the same name as the username. In sshd_config I have:


    AllowGroups (blank)


    This lets anyone use ssh without restriction by group or username.


    pwd login only

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    Typo in Guide:


    This line:


    Run service openmediavault-engined restart && omv-mkconf ssh && service restart ssh


    Should be:


    Run service openmediavault-engined restart && omv-mkconf ssh && service ssh restart

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    Jan 11 16:17:24 omv sshd[10555]: Accepted password for hork from 127.0.0.1 port 35299 ssh2
    Jan 11 16:17:24 omv sshd[10555]: pam_unix(sshd:session): session opened for user hork by (uid=0)
    Jan 11 16:17:24 omv sshd[10558]: fatal: bad ownership or modes for chroot directory component "/"
    Jan 11 16:17:24 omv sshd[10555]: pam_unix(sshd:session): session closed for user hork


    The ownership and permissions are correct:


    /home is owned by root:root and chmod 0755
    /home/hork is owned by root:root and chmod 0755


    BUT..........what fixed it was:


    root@omv:~# chmod 0755 /


    How did that get changed away from correct?


    Thanks for your time.

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    • Offizieller Beitrag

    From the man:


    Specifies the pathname of a directory to chroot(2) to after authentication. At session startup sshd(8) checks that all components of the pathname are root-owned directories which are not writable by any other user or group. After the chroot, sshd(8) changes the working directory to the user's home directory.


    So it has to include /
    I'll add a note to the guide.

    I was aware of the permissions and ownership requirements, but only considered them for the directories that are created as part of this process.


    It never occurred to me that / was somehow changed away from what worked last week to what broke this week. This raises two questions:


    How does one view the permissions and ownership of / ?


    What happened to my OMV to cause the permissions on / to change?


    All I did to fix this was to chmod 0755 /

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!

Benutzerkonto erstellen Anmelden