6 ms·

SFTP is included in all distributions of OpenSSH, and the procedure to restrict it to chrooted file transfer without shell access is well-known. It is: Matc

by chasil 4y ago

SFTP is included in all distributions of OpenSSH, and the procedure to restrict it to chrooted file transfer without shell access is well-known. It is: Match Group sftponly ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no (Open)rsync is not included in OpenSSH, and it likely never will be. There may be multiple approaches to implement the above configuration with either the older GPL or newer BSD implementation of rsync, and the capabilities between the two variants will differ, adding further complexity. The established best practice is the above configuration, for these reasons.

Brian_K_White 4y ago
Like I said, you must always access sftp through the ssh server. It relies on trusting the configs to avoid a shell. It means it's possible for sshd to supply a shell if it's merely confused about the config. It doesn't matter how "established" the config is. You are looking at what the config is supposed to do and thinking that is all nice and bulletproof looking. But that nice config that says "user X only gets the sftp subsystem" goes right out the window if you merely confuse sshd that you are not "user X" or any of the other match conditions. Rsyncd on the other hand, has no code in it to offer up a shell. It can't be tricked into doing something that it has no code for in the first place. The only reason ssh is usually involved with rsync is simply that rsync is not encrypted, so you tunnel rsync over some other channel to add encryption to it, and ssh is the most handy. But that other channel can actually be anything. It doesn't have to be ssh, and it doesn't even have to be any other form of shell server. For instance you could run a direct rsyncd and access it via vpn or tls tunnel, where together the two parts get you encrypted rsync and neither component posesses any ability to launch a shell, no matter what happens with the configs and no mattet what exploits come along.
- chasil 4y ago
  It is not strictly true that SFTP must be accessed through SSH. I actually jacked it into stunnel once, full details in that past post, which google remembers quite well: https://news.ycombinator.com/item?id=19520422 https://news.ycombinator.com/item?id=19520422 Tinyssh also has no config file; if you want it to service sftp, it must be passed in argv at startup, so less confusion there. And there are two rsyncs now, so you have to be specific about which one. You likely mean the original, and not this one (the same people who wrote this had a showstopper bug in their new mail server): https://www.openrsync.org/ https://www.openrsync.org/
  - Brian_K_White 4y ago
    That stunnel hack is cool.
    - chasil 4y ago
      Thanks; I guess a had a few idle moments.

by chasil 4y ago

Brian_K_White 4y ago

Like I said, you must always access sftp through the ssh server. It relies on trusting the configs to avoid a shell. It means it's possible for sshd to supply a shell if it's merely confused about the config. It doesn't matter how "established" the config is. You are looking at what the config is supposed to do and thinking that is all nice and bulletproof looking. But that nice config that says "user X only gets the sftp subsystem" goes right out the window if you merely confuse sshd that you are not "user X" or any of the other match conditions. Rsyncd on the other hand, has no code in it to offer up a shell. It can't be tricked into doing something that it has no code for in the first place. The only reason ssh is usually involved with rsync is simply that rsync is not encrypted, so you tunnel rsync over some other channel to add encryption to it, and ssh is the most handy. But that other channel can actually be anything. It doesn't have to be ssh, and it doesn't even have to be any other form of shell server. For instance you could run a direct rsyncd and access it via vpn or tls tunnel, where together the two parts get you encrypted rsync and neither component posesses any ability to launch a shell, no matter what happens with the configs and no mattet what exploits come along.

chasil 4y ago
It is not strictly true that SFTP must be accessed through SSH. I actually jacked it into stunnel once, full details in that past post, which google remembers quite well: https://news.ycombinator.com/item?id=19520422 https://news.ycombinator.com/item?id=19520422 Tinyssh also has no config file; if you want it to service sftp, it must be passed in argv at startup, so less confusion there. And there are two rsyncs now, so you have to be specific about which one. You likely mean the original, and not this one (the same people who wrote this had a showstopper bug in their new mail server): https://www.openrsync.org/ https://www.openrsync.org/
- Brian_K_White 4y ago
  That stunnel hack is cool.
  - chasil 4y ago
    Thanks; I guess a had a few idle moments.