OpenSSH SFTP chroot() with ChrootDirectory

Posted by niol on Tue 1 Apr 2008 at 10:49

Tags: , ,

The upcoming version of OpenSSH (4.8p1 for the GNU/Linux port) features a new configuration option : ChrootDirectory. This has been made possible by a new SFTP subsystem statically linked to sshd.

This makes it easy to replace a basic FTP service without the hassle of configuring encryption and/or bothering with FTP passive and active modes when operating through a NAT router. This is also simpler than packages such as rssh, scponly or other patches because it does not require setting up and maintaining (i.e. security updates) a chroot environment.

To enable it, you obviously need the new version 4.8p1. I personaly use the cvs version and the debian/ directory of the sid package to build a well integrated Debian package 4.8p1~cvs-1.

In /etc/ssh/sshd_config :

You need to configure OpenSSH to use its internal SFTP subsystem.

Subsystem sftp internal-sftp

Then, I configured chroot()ing in a match rule.

Match group sftponly
         ChrootDirectory /home/%u
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp

The directory in which to chroot() must be owned by root. After the call to chroot(), sshd changes directory to the home directory relative to the new root directory. That is why I use / as home directory.

# chown root.root /home/user
# usermod -d / user
# adduser user sftponly

This seems to work as expected :

$ sftp user@host
Connecting to host...
user@host's password:
sftp> ls
build               cowbuildinall       incoming            johnbuilderclean
sftp> pwd
Remote working directory: /
sftp> cd ..
sftp> ls
build               cowbuildinall       incoming            johnbuilderclean

The only thing I miss is file transfers logging, but I did not investigate this at all. More on this whenever I find some time to do so.

References :

Share/Save/Bookmark


Posted by Anonymous (97.89.xx.xx) on Tue 1 Apr 2008 at 14:49
This sounds awesome and thank you for posting it.

But I've learned not to trust anything posted on this day...

[ Parent | Reply to this comment ]

Posted by Anonymous (38.104.xx.xx) on Tue 1 Apr 2008 at 14:53
From the FAQ:
Note that OpenSSH 4.8 was an OpenBSD-only release shipped with the
OpenBSD 4.3 CD.

[ Parent | Reply to this comment ]

Posted by Anonymous (200.160.xx.xx) on Tue 1 Apr 2008 at 16:40
Nice work!
OpenSSH 4.9 is OUT!

[ Parent | Reply to this comment ]

Posted by Anonymous (217.154.xx.xx) on Wed 2 Apr 2008 at 21:25
I considered using this (as I put together the alternative approach at http://www.minstrel.org.uk/papers/sftp/), but from reading 'man sshd_config', it appeared to me that 'ChrootDirectory' was *not* a valid parameter in a Match block.

Have I misread the manual? It struck me that ChrootDirectory subsequently applied to all users (including myself), which wouldn't work for me at all...

I can be contacted through the Web site above.

--
Minstrel

[ Parent | Reply to this comment ]

Posted by Anonymous (91.45.xx.xx) on Sun 6 Apr 2008 at 14:06
ChrootDirectory is a valid directive in a Match block. The man page sshd_config(5) however, doesn't list it correctly. But since we can use the force^Wsource ;), it is not a big problem to verify this. see servconf.c (of OpenSSH 5.0) line 275-372:
#define SSHCFG_GLOBAL   0x01    /* allowed in main section of sshd_config */
#define SSHCFG_MATCH    0x02    /* allowed inside a Match section */
#define SSHCFG_ALL      (SSHCFG_GLOBAL|SSHCFG_MATCH)

/* Textual representation of the tokens. */
static struct {
        const char *name;
        ServerOpCodes opcode;
        u_int flags;
} keywords[] = {

        // [...]
        { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
        // [...]
};
HTH

[ Parent | Reply to this comment ]

Posted by Anonymous (203.163.xx.xx) on Thu 3 Apr 2008 at 01:18
Does the chroot apply for SSH shell access, or only sftp?

[ Parent | Reply to this comment ]

Posted by Anonymous (91.45.xx.xx) on Sun 6 Apr 2008 at 14:09
It applies to all shell access via SSH. But if you do not use internal-sftp, you'll still need to have all libraries and binaries the user shall be able to use inside his/her home directory.

[ Parent | Reply to this comment ]

Posted by Anonymous (213.211.xx.xx) on Tue 8 Apr 2008 at 07:28
You can use Jailkit from http://olivier.sessink.nl/jailkit/ to manage all the libraries and binaries.

With Jailkit you can also do a similar setup as above with cvs, rsync and scp.

[ Parent | Reply to this comment ]

Posted by Anonymous (82.229.xx.xx) on Thu 3 Apr 2008 at 15:24
Any ssh backport for etch planned ?

[ Parent | Reply to this comment ]

Posted by Anonymous (80.69.xx.xx) on Fri 4 Apr 2008 at 08:43
I did one on my own as mentioned above - no problem with it so far.

[ Parent | Reply to this comment ]

Posted by Anonymous (82.101.xx.xx) on Fri 4 Apr 2008 at 14:14
Have you put it on a repository?
and have you seen OpenSSH 5.0/5.0p1 released Apr 3, 2008?

[ Parent | Reply to this comment ]

Posted by sytoka (80.170.xx.xx) on Sun 6 Apr 2008 at 07:45
[ Send Message ]

Just change

# chown root.root /home/user

by

# chown root:root /home/user

It's now possible to have a dot in a username !

[ Parent | Reply to this comment ]

Posted by Anonymous (70.145.xx.xx) on Wed 9 Apr 2008 at 20:33
Great!

Can't wait to try it.

Brian Pence
Celestial Software
http://www.celestialsoftware.net
AbsoluteTelnet (for telnet and ssh)

[ Parent | Reply to this comment ]

Posted by Anonymous (217.18.xx.xx) on Tue 15 Apr 2008 at 09:50
I can't locate internal-sftp command. When i try locate or find he not locate anywhere internal-sftp. How i can download this?

[ Parent | Reply to this comment ]

Posted by Anonymous (74.233.xx.xx) on Sat 17 May 2008 at 19:10
internal-sftp is not an external system command. It's an internal to OpenSSH specification that is used only in the sshd configuration file.

[ Parent | Reply to this comment ]

User Login

Username:

Password:

[ Advanced Login ]

Register Account

Quick Site Search