5 ms·

For the unknowing, use rsync instead of sftp if you possibly can. Odds are high you can. But if you're dealing with a multi billion dollar company that says "n

For the unknowing, use rsync instead of sftp if you possibly can. Odds are high you can. But if you're dealing with a multi billion dollar company that says "no", then this guide could come in handy.

chasil 4y ago
An untrusted sftp account can be confined to a chroot(). This would be more difficult to do with rsync. I'd also be concerned with the account getting a shell, even if the command= option is set in authorized_keys.
- Brian_K_White 4y ago
  An sftp account is still an ssh account, and you certainly can chroot rsync. In both cases the client is acessing an ssh server and relying on mere config files to ensure that the ssh server launches something other than a shell. However rsync is also it's own service that doesn't have to use ssh at all, meaning no possible risk of getting a shell. It can be chrooted both from within and without (it can manage chroots of shares, and it can be chrooted itself). And wire encryption could be layered on some other way. ssh is merely convenient.
  - chasil 4y ago
    SFTP is included in all distributions of OpenSSH, and the procedure to restrict it to chrooted file transfer without shell access is well-known. It is: Match Group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no (Open)rsync is not included in OpenSSH, and it likely never will be. There may be multiple approaches to implement the above configuration with either the older GPL or newer BSD implementation of rsync, and the capabilities between the two variants will differ, adding further complexity. The established best practice is the above configuration, for these reasons.
    - Brian_K_White 4y ago
      Like I said, you must always access sftp through the ssh server. It relies on trusting the configs to avoid a shell. It means it's possible for sshd to supply a shell if it's merely confused about the config. It doesn't matter how "established" the config is. You are looking at what the config is supposed to do and thinking that is all nice and bulletproof looking. But that nice config that says "user X only gets the sftp subsystem" goes right out the window if you merely confuse sshd that you are not "user X" or any of the other match conditions. Rsyncd on the other hand, has no code in it to offer up a shell. It can't be tricked into doing something that it has no code for in the first place. The only reason ssh is usually involved with rsync is simply that rsync is not encrypted, so you tunnel rsync over some other channel to add encryption to it, and ssh is the most handy. But that other channel can actually be anything. It doesn't have to be ssh, and it doesn't even have to be any other form of shell server. For instance you could run a direct rsyncd and access it via vpn or tls tunnel, where together the two parts get you encrypted rsync and neither component posesses any ability to launch a shell, no matter what happens with the configs and no mattet what exploits come along.
      - chasil 4y ago
        It is not strictly true that SFTP must be accessed through SSH. I actually jacked it into stunnel once, full details in that past post, which google remembers quite well: https://news.ycombinator.com/item?id=19520422 https://news.ycombinator.com/item?id=19520422 Tinyssh also has no config file; if you want it to service sftp, it must be passed in argv at startup, so less confusion there. And there are two rsyncs now, so you have to be specific about which one. You likely mean the original, and not this one (the same people who wrote this had a showstopper bug in their new mail server): https://www.openrsync.org/ https://www.openrsync.org/
        Brian_K_White 4y ago
        That stunnel hack is cool.
        4y ago
encryptluks2 4y ago
Why do you think rsync is a better alternative to SFTP when merely uploading files? rsync is great when syncing large amounts of files, but I see no advantages when needing to have a method for customers to upload files.

For the unknowing, use rsync instead of sftp if you possibly can. Odds are high you can. But if you're dealing with a multi billion dollar company that says "no", then this guide could come in handy.

chasil 4y ago

An untrusted sftp account can be confined to a chroot(). This would be more difficult to do with rsync. I'd also be concerned with the account getting a shell, even if the command= option is set in authorized_keys.

Brian_K_White 4y ago
An sftp account is still an ssh account, and you certainly can chroot rsync. In both cases the client is acessing an ssh server and relying on mere config files to ensure that the ssh server launches something other than a shell. However rsync is also it's own service that doesn't have to use ssh at all, meaning no possible risk of getting a shell. It can be chrooted both from within and without (it can manage chroots of shares, and it can be chrooted itself). And wire encryption could be layered on some other way. ssh is merely convenient.
- chasil 4y ago
  SFTP is included in all distributions of OpenSSH, and the procedure to restrict it to chrooted file transfer without shell access is well-known. It is: Match Group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no (Open)rsync is not included in OpenSSH, and it likely never will be. There may be multiple approaches to implement the above configuration with either the older GPL or newer BSD implementation of rsync, and the capabilities between the two variants will differ, adding further complexity. The established best practice is the above configuration, for these reasons.
  - Brian_K_White 4y ago
    Like I said, you must always access sftp through the ssh server. It relies on trusting the configs to avoid a shell. It means it's possible for sshd to supply a shell if it's merely confused about the config. It doesn't matter how "established" the config is. You are looking at what the config is supposed to do and thinking that is all nice and bulletproof looking. But that nice config that says "user X only gets the sftp subsystem" goes right out the window if you merely confuse sshd that you are not "user X" or any of the other match conditions. Rsyncd on the other hand, has no code in it to offer up a shell. It can't be tricked into doing something that it has no code for in the first place. The only reason ssh is usually involved with rsync is simply that rsync is not encrypted, so you tunnel rsync over some other channel to add encryption to it, and ssh is the most handy. But that other channel can actually be anything. It doesn't have to be ssh, and it doesn't even have to be any other form of shell server. For instance you could run a direct rsyncd and access it via vpn or tls tunnel, where together the two parts get you encrypted rsync and neither component posesses any ability to launch a shell, no matter what happens with the configs and no mattet what exploits come along.
    - chasil 4y ago
      It is not strictly true that SFTP must be accessed through SSH. I actually jacked it into stunnel once, full details in that past post, which google remembers quite well: https://news.ycombinator.com/item?id=19520422 https://news.ycombinator.com/item?id=19520422 Tinyssh also has no config file; if you want it to service sftp, it must be passed in argv at startup, so less confusion there. And there are two rsyncs now, so you have to be specific about which one. You likely mean the original, and not this one (the same people who wrote this had a showstopper bug in their new mail server): https://www.openrsync.org/ https://www.openrsync.org/
      - Brian_K_White 4y ago
        That stunnel hack is cool.
        4y ago

encryptluks2 4y ago

Why do you think rsync is a better alternative to SFTP when merely uploading files? rsync is great when syncing large amounts of files, but I see no advantages when needing to have a method for customers to upload files.