0

I'm trying to make a chrooted SFTP account which could allow only upload of files into an unique directory - ie. /upload/$timestamp. Let's imagine that it is a shared upload account where one can upload files for a support team:

  • thus each session should upload to specific directory
  • SFTP sessions should not be able to write to any other directory
  • and of course to delete anything.

I have something ready but I'm not sure about blacklisting/whitelisting of sftp-server requests.

See http://man.openbsd.org/sftp-server.

Match User support
      ChrootDirectory /home/testssh
      ForceCommand /test.sh

The wrapper creates an unique directory and exec sftp-server with -d (that is should chdir into the unique directory) and sets -P to blacklist specific syscalls. (I had to manually create chroot env as I don't use internal-sftp because I need to run my ksh shell wrapper, mkdir, date and full sftp-server. If you would not need this, just use internal-sftp as ForceCommand!)

#!/bin/ksh

set -eu

[[ -z "${SSH_ORIGINAL_COMMAND:-}" ]] && exit 1

case "${SSH_ORIGINAL_COMMAND}" in
    "/usr/libexec/sftp-server")
        [[ -d /upload && -w /upload ]] || exit 1

        TARGETDIR=/upload/$(date -u +"%Y%m%d%H%m%S.%s")
        [[ ! -d ${TARGETDIR} ]] && mkdir ${TARGETDIR}
        [[ $? != 0 ]] && exit 1

        exec /usr/libexec/sftp-server -d ${TARGETDIR} -l DEBUG3 -P mkdir,rmdir,remove,stat,rename,symlink,posix-rename,statvfs,fstatvfs,hardlink,fsync
        ;;
    *)
        exit 1
        ;;
esac

Let's check a session, step by step.

$ sftp support@mx1
Connected to mx1.
sftp>

Log:

Jan 28 18:35:01 mx1 sshd[73095]: Starting session: forced-command (config) '/test.sh' for support from 176.x.x.x port 59712 id 0
Jan 28 18:35:01 mx1 sftp-server[53717]: session opened for local user supp0r7 from [176.x.x.x]
Jan 28 18:35:01 mx1 sftp-server[53717]: received client version 3
Jan 28 18:35:02 mx1 sftp-server[53717]: realpath "."

pwd

sftp> pwd
Remote working directory: /upload/20190128230101.1548718501
sftp>

ls -al

sftp> ls -al
drwxr-xr-x    2 support  support       512 Jan 28 23:35 .
drwxr-xr-x   19 support  support      1024 Jan 28 23:35 ..
sftp> 

Jan 28 18:36:41 mx1 sftp-server[53717]: opendir "/upload/20190128230101.1548718501"
Jan 28 18:36:41 mx1 sftp-server[53717]: sent status End of file
Jan 28 18:36:41 mx1 sftp-server[53717]: closedir "/upload/20190128230101.1548718501"
Jan 28 18:36:41 mx1 sftp-server[53717]: sent status Success

cd /

sftp> cd /
Couldn't stat remote file: Permission denied

Jan 28 18:37:02 mx1 sftp-server[53717]: realpath "/"
Jan 28 18:37:02 mx1 sftp-server[53717]: Refusing blacklisted stat request
Jan 28 18:37:02 mx1 sftp-server[53717]: sent status Permission denied

put /etc/fstab

sftp> put /etc/fstab
Uploading /etc/fstab to /upload/20190128230101.1548718501/fstab
/etc/fstab                                                                                                                                                                                                  100% 1012     9.3KB/s   00:00   


Jan 28 18:37:22 mx1 sftp-server[53717]: open "/upload/20190128230101.1548718501/fstab" flags WRITE,CREATE,TRUNCATE mode 0644
Jan 28 18:37:22 mx1 sftp-server[53717]: sent status Success
Jan 28 18:37:22 mx1 sftp-server[53717]: close "/upload/20190128230101.1548718501/fstab" bytes read 0 written 1012
Jan 28 18:37:22 mx1 sftp-server[53717]: sent status Success

rm fstab

sftp> rm fstab
Removing /upload/20190128230101.1548718501/fstab
Couldn't delete file: Permission denied

Jan 28 18:37:42 mx1 sftp-server[53717]: lstat name "/upload/20190128230101.1548718501/fstab"
Jan 28 18:37:42 mx1 sftp-server[53717]: Refusing blacklisted remove request
Jan 28 18:37:42 mx1 sftp-server[53717]: sent status Permission denied

ls -l fstab

sftp> ls -l fstab
-rw-r--r--    0 1000     1000         1012 Jan 29 00:37 fstab
sftp> ls -al
drwxr-xr-x    2 support  support       512 Jan 28 23:38 .
drwxr-xr-x   19 support  support      1024 Jan 28 23:35 ..
-rw-r--r--    1 support  support      1012 Jan 28 23:37 fstab

Jan 28 18:38:04 mx1 sftp-server[53717]: lstat name "/upload/20190128230101.1548718501/fstab"
Jan 28 18:38:08 mx1 sftp-server[53717]: opendir "/upload/20190128230101.1548718501"
Jan 28 18:38:08 mx1 sftp-server[53717]: sent status End of file
Jan 28 18:38:08 mx1 sftp-server[53717]: closedir "/upload/20190128230101.1548718501"
Jan 28 18:38:08 mx1 sftp-server[53717]: sent status Success

rename fstab whatever

sftp> rename fstab whatever
Couldn't rename file "/upload/20190128230101.1548718501/fstab" to "/upload/20190128230101.1548718501/whatever": Permission denied

Jan 28 18:38:56 mx1 sftp-server[53717]: Refusing blacklisted posix-rename request
Jan 28 18:38:56 mx1 sftp-server[53717]: sent status Permission denied

So, is that ok? Any doubts?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.