SFTP Plugin Problem

HannesJo · Dec 20th 2019

Just getting familiar with the SFTP plugin and in the beginning, I was able to connect but got listed the complete root directory. Not only the sharedfolder to be displayed. So I noticed that I should join the group sftp-access but now I cant even connect anymore. Getting error message

Code

Fehler:	Network error: Software caused connection abort
Fehler:	Herstellen der Verbindung zum Server fehlgeschlagen

Any ideas? Thanks!

ryecoaaron · Dec 20th 2019

Is the sftp server running? The service status page should tell you. Unlike some of the other plugins I maintain, I know this plugin well and it is working in all of my tests.

HannesJo · Dec 20th 2019

Yes service page shows 2 green dots. I wonder if there is some log somewhere?

HannesJo · Dec 20th 2019

Did some more tests but whatever I do. I can only connect as long as user is not in group sftp-access, but whole root tree is displayed then.
Adding the user to sftp-access, I cannot login anymore due to "connection abort".
Turning On "Allow Groups" while user is not in sftp-access leads to "Auth failed".
Joining the group again leads to "connection abort".

Found no other settings that would change anything. Sys Log displays "service started" only. Going to SFTP LOG I get the error "Failed to open the log file (filename=/var/log/openmediavault-sftp.log).".

@ryecoaaron any further tips?

Edit:
So in the auth.log I found the error message
'fatal: bad ownership or modes for chroot directory component "/"'

and therefore I checked the permissions. I found that my / was set as root:root 775 and not root:root 755.
I backed up my system and changed the permissions with "chmod 755 /".

After that, auth.log gave me another error saying
'fatal: safely_chroot: stat("/sftp/"): No such file or directory'

So I checked /etc/ssh/omv_sftp_config and there it says 'ChrootDirectory /sftp/%u'. Ok, creating the dir /sftp/testUser/blabla/ with the right permissions and I can finally connect and I see only the directory blabla/.

But what is going on there? In the OMV GUI at SFTP in the Access List TAB I set testUser should see the sharedfolder "testSF". That setting seems to be ignored. Why is omv_sftp_config chroot'in to /sftp/%u?

ryecoaaron · Dec 21st 2019

Quote from HannesJo

But what is going on there?

The plugin should be creating /sftp. Not sure why it didn't on your system.

Quote from HannesJo

In the OMV GUI at SFTP in the Access List TAB I set testUser should see the sharedfolder "testSF". That setting seems to be ignored. Why is omv_sftp_config chroot'in to /sftp/%u?

Your system doesn't seem to be applying any settings. What is the output of omv-salt deploy run sftp followed by omv-salt deploy run fstab. The plugin uses /sftp because it bind mounts each sharedfolder you give access to in the user's directory in /sftp. This is how it only shows the selected sharedfolders when the user is in the sftp-access group.

HannesJo · Dec 21st 2019

Hmm ok, that is really interesting. Have never had the situation of settings not being applied.

Output is:

Code

root@NAS:~# omv-salt deploy run sftp
debian:
----------
          ID: configure_omv_sftp_config
    Function: file.managed
        Name: /etc/ssh/omv_sftp_config
      Result: True
     Comment: File /etc/ssh/omv_sftp_config is in the correct state
     Started: 15:31:36.422733
    Duration: 60.817 ms
     Changes:
----------
          ID: configure_omv_sftp_rsyslog_config
    Function: file.managed
        Name: /etc/rsyslog.d/openmediavault-sftp.conf
      Result: True
     Comment: File /etc/rsyslog.d/openmediavault-sftp.conf is in the correct state
     Started: 15:31:36.483730
    Duration: 9.02 ms
     Changes:
----------
          ID: start_omv_sftp_service
    Function: service.running
        Name: omv-sftp
      Result: True
     Comment: The service omv-sftp is already running
     Started: 15:31:36.502021
    Duration: 52.08 ms
     Changes:


Summary for debian
------------
Succeeded: 3
Failed:    0
------------
Total states run:     3
Total run time: 121.917 ms

Display More

Code

root@NAS:~# omv-salt deploy run fstab
/usr/lib/python3/dist-packages/salt/utils/decorators/signature.py:31: DeprecationWarning: `formatargspec` is deprecated since Python 3.5. Use `signature` and the `Signature` object directly
  *salt.utils.args.get_function_argspec(original_function)
debian:
----------
          ID: create_filesystem_mountpoint_b01944dd-e4cc-43af-b140-b6843097b03d
    Function: file.accumulated
      Result: True
     Comment: Accumulator create_filesystem_mountpoint_b01944dd-e4cc-43af-b140-b6843097b03d for file /etc/fstab was charged by text
     Started: 15:32:49.315934
    Duration: 0.819 ms
     Changes:
----------
          ID: mount_filesystem_mountpoint_b01944dd-e4cc-43af-b140-b6843097b03d
    Function: mount.mounted
        Name: /srv/dev-disk-by-id-ata-CT250MX500SSD1_1924E20C33E4-part4
      Result: True
     Comment: Target was already mounted
     Started: 15:32:49.317734
    Duration: 256.651 ms
     Changes:
              ----------
              umount:
                  Forced remount because options (acl) changed
----------
          ID: create_filesystem_mountpoint_20fffa8d-98fe-4067-a8a3-a0078630b9f3
    Function: file.accumulated
      Result: True
     Comment: Accumulator create_filesystem_mountpoint_20fffa8d-98fe-4067-a8a3-a0078630b9f3 for file /etc/fstab was charged by text
     Started: 15:32:49.574786
    Duration: 1.578 ms
     Changes:
----------
          ID: mount_filesystem_mountpoint_20fffa8d-98fe-4067-a8a3-a0078630b9f3
    Function: mount.mounted
        Name: /srv/dev-disk-by-label-Storage
      Result: True
     Comment: Target was already mounted
     Started: 15:32:49.576520
    Duration: 79.697 ms
     Changes:
              ----------
              umount:
                  Forced remount because options (acl) changed
----------
          ID: create_sftp_mountpoint_ac2eace9-1bdf-42e3-a670-bcb18874e61a
    Function: file.accumulated
      Result: True
     Comment: Accumulator create_sftp_mountpoint_ac2eace9-1bdf-42e3-a670-bcb18874e61a for file /etc/fstab was charged by text
     Started: 15:32:49.656603
    Duration: 1.568 ms
     Changes:
----------
          ID: mount_sftp_mountpoint_ac2eace9-1bdf-42e3-a670-bcb18874e61a
    Function: mount.mounted
        Name: /sftp/test/testSF
      Result: True
     Comment: Target was successfully mounted
     Started: 15:32:49.658321
    Duration: 50.273 ms
     Changes:
              ----------
              mount:
                  True
----------
          ID: append_fstab_entries
    Function: file.blockreplace
        Name: /etc/fstab
      Result: True
     Comment: Changes were made
     Started: 15:32:49.710626
    Duration: 7.317 ms
     Changes:
              ----------
              diff:
                  ---
                  +++
                  @@ -14,4 +14,5 @@
                   # >>> [openmediavault]
                   /dev/disk/by-id/ata-CT250MX500SSD1_1924E20C33E4-part4                /srv/dev-disk-by-id-ata-CT250MX500SSD1_1924E20C33E4-part4       ext4    defaults,nofail,user_xattr,exec,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0,discard,acl    0 2
                   /dev/disk/by-label/Storage           /srv/dev-disk-by-label-Storage  ext4    defaults,nofail,user_xattr,noexec,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0,acl  0 2
                  +/srv/dev-disk-by-label-Storage/testSF/               /sftp/test/testSF       none    bind,ro,nofail 0 0
                   # <<< [openmediavault]


Summary for debian
------------
Succeeded: 7 (changed=4)
Failed:    0
------------
Total states run:     7
Total run time: 397.903 ms

Display More

Seems to work now. I can connect and see my shared folder. Thank you!! But any idea what could have caused that problems?

ryecoaaron · Dec 21st 2019

The sftp module isn't being marked as dirty for some reason. I don't have this problem on my system. What is the output of: dpkg -l | grep openm

HannesJo · Dec 21st 2019

Code

root@NAS:~# dpkg -l | grep openm
ii  openmediavault                  5.1.3-1                             all          openmediavault - The open network attached storage solution
ii  openmediavault-diskstats        5.0.1-1                             all          OpenMediaVault disk monitoring plugin
ii  openmediavault-flashmemory      5.0.1                               all          folder2ram plugin for OpenMediaVault
ii  openmediavault-keyring          1.0                                 all          GnuPG archive keys of the OpenMediaVault archive
ii  openmediavault-omvextrasorg     5.1.11                              all          OMV-Extras.org Package Repositories for OpenMediaVault
ii  openmediavault-sftp             5.0                                 all          sftp server
ii  openmediavault-usbbackup        5.0.2-1                             all          OpenMediaVault USB/eSATA backup plugin

ryecoaaron · Dec 21st 2019

That looks fine. If you add access to another sharedfolder in sftp, is it added?

HannesJo · Dec 21st 2019

No. Only when I delete an element, settings are applied.

ryecoaaron · Dec 21st 2019

I found the problem. Working on a fix. Not sure why it didn't affect the 4.x plugin though.

HannesJo · Dec 21st 2019

Awesome! Thanks for the kind help!

ryecoaaron · Dec 21st 2019

5.0.1 is in the repo now.

HannesJo · Dec 21st 2019

That was quick! Works like a charm.

HannesJo · Dec 21st 2019

@ryecoaaron There is another small problem. When I add another user to sftp group and access list, directory /sftp/anotherUser is created with wrong permission root:root 777.

ryecoaaron · Dec 21st 2019

Quote from HannesJo

When I add another user to sftp group and access list, directory /sftp/anotherUser is created with wrong permission root:root 777

The plugin isn't specifying what permissions to create that directory with. I will have to add code to set the user's root directory to 755.

HannesJo · Dec 21st 2019

Hmm that is strange since the umask is 0022, so default permission should be 755. Am I missing sth.?

ryecoaaron · Dec 21st 2019

Quote from HannesJo

Am I missing sth.?

I don't know how the code behind the mountpoint creation works. So, I just changed the plugin to create the directory with the correct ownership and permissions before the mountpoint is created. 5.0.2 is in the repo.

HannesJo · Dec 21st 2019

Great!

nicodemus · Dec 29th 2019

Quote from HannesJo

Did some more tests but whatever I do. I can only connect as long as user is not in group sftp-access, but whole root tree is displayed then.
Adding the user to sftp-access, I cannot login anymore due to "connection abort".
Turning On "Allow Groups" while user is not in sftp-access leads to "Auth failed".
Joining the group again leads to "connection abort".

Found no other settings that would change anything. Sys Log displays "service started" only. Going to SFTP LOG I get the error "Failed to open the log file (filename=/var/log/openmediavault-sftp.log).".

@ryecoaaron any further tips?

Edit:
So in the auth.log I found the error message
'fatal: bad ownership or modes for chroot directory component "/"'

and therefore I checked the permissions. I found that my / was set as root:root 775 and not root:root 755.
I backed up my system and changed the permissions with "chmod 755 /".

After that, auth.log gave me another error saying
'fatal: safely_chroot: stat("/sftp/"): No such file or directory'

So I checked /etc/ssh/omv_sftp_config and there it says 'ChrootDirectory /sftp/%u'. Ok, creating the dir /sftp/testUser/blabla/ with the right permissions and I can finally connect and I see only the directory blabla/.

But what is going on there? In the OMV GUI at SFTP in the Access List TAB I set testUser should see the sharedfolder "testSF". That setting seems to be ignored. Why is omv_sftp_config chroot'in to /sftp/%u?

Display More

Same problem here with the privilege in /
Same error message. I could solve the error with chmod 755 /
After that everything works as expected and the user is jail. The folders were correctly created so, in my case, just a chmod problem

Version omv 4

Thanks

Enviado desde mi SM-G960F mediante Tapatalk

Participate now!