Thread: sftp requests don't go via rssh
Brought to you by:
xystrus
From: Petyo V. <pi...@gm...> - 2014-01-29 16:43:01
|
Hello All, I've setup rssh to what seemed to be a proper configuration but I noticed that sftp doesn't go at all via rssh. And therefore doesn't go in the chroor jail.It just goes via the default sftp module of ssh. rssh.conf: logfacility = LOG_USER allowscp allowsftp umask = 022 chrootpath = /export user=user:007:00011:/export/user user:x:2004:2004:no shell user:/export/user:/usr/bin/rssh /var/log/messages contains this upon creating a scp connection: Jan 29 17:15:36 server01 rssh[18356]: setting log facility to LOG_USER Jan 29 17:15:36 server01 rssh[18356]: allowing scp to all users Jan 29 17:15:36 server01 rssh[18356]: allowing sftp to all users Jan 29 17:15:36 server01 rssh[18356]: setting umask to 022 Jan 29 17:15:36 server01 rssh[18356]: chrooting all users to /chrootpl Jan 29 17:15:36 server01 rssh[18356]: line 53: configuring user user Jan 29 17:15:36 server01 rssh[18356]: setting user's umask to 07 Jan 29 17:15:36 server01 rssh[18356]: allowing scp to user user Jan 29 17:15:36 server01 rssh[18356]: allowing sftp to user user Jan 29 17:15:36 server01 rssh[18356]: chrooting user to /export/user Jan 29 17:15:36 server01 rssh[18356]: chroot cmd line: /usr/libexec/rssh_chroot_helper 1 "scp -t in/" but nothing when sftp is connecting. the sshd_config has only this about sftp: Subsystem sftp internal-sftp when I have a match rule in the sftp the scp doesn't work: Match group noshell ChrootDirectory %h X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp so this is no commented out. Has anyone else also noticed this? Does anyone have any pointers? -- Best Regards, Petyo Vodenicharov |
From: Russ A. <ea...@ey...> - 2014-01-29 21:23:01
|
Petyo Vodenicharov <pi...@gm...> writes: > I've setup rssh to what seemed to be a proper configuration but I > noticed that sftp doesn't go at all via rssh. And therefore doesn't go > in the chroor jail.It just goes via the default sftp module of ssh. > the sshd_config has only this about sftp: > Subsystem sftp internal-sftp When you use subsystem support for sftp, I believe the sshd server never runs a shell or uses the command sent by the client. It instead spawns the sftp server directly or uses the internal built-in sftp implementation. You would therefore have to configure sshd's internal chroot support. rssh can't help with that. I believe you can force the sftp client and sshd server to fall back to running the sftp server command via a shell by disabling the sftp subsystem in the sshd server, at which point those requests should route through rssh again. But I've not tried it. -- Russ Allbery (ea...@ey...) <http://www.eyrie.org/~eagle/> |