openssh unix dev - Jun 2006 - [PATCH] sftp-server Restricted Access

Hello,

This patch makes it possible to restrict sftp sessions to a certain
subtree of the file system on a per-Unix account basis. It requires a
program such as rssh or scponly to function. A patch for rssh is also
attached to this email.
The method employed uses realpath() and a string comparison to check
that each file or directory access is allowed.
With this patch, sftp-server takes a command-line argument to indicate
the directory to which the user will be restricted. Without this
argument, the patch has no noticeable effect. Rssh execv()s sftp-server
with this argument if rssh.conf tells it to.

Please note that this patch is written for the portable distribution of
OpenSSH 4.3.

Your comments will be appreciated.


Best regards,

Julien Demoor


-------------- next part --------------
A non-text attachment was scrubbed...
Name: rssh-restricted-patch-1.0.tar.gz
Type: application/gzip
Size: 3356 bytes
Desc: not available
Url :
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20060624/e5a21fbd/attachment.bin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sftp-restricted-patch-1.0.tar.gz
Type: application/gzip
Size: 4102 bytes
Desc: not available
Url :
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20060624/e5a21fbd/attachment-0001.bin

Julien Demoor wrote:
> Hello,
> 
> This patch makes it possible to restrict sftp sessions to a certain
> subtree of the file system on a per-Unix account basis. 
There has been a similar patch in bugzilla for a while:

http://bugzilla.mindrot.org/attachment.cgi?id=586

I'm looking at adding the ability to specify commandline arguments to
SubSystem declarations in sshd_config, but it is a little fiddly as any
change has to gracefully cope with forced commands in authorized_keys
files as well as the fairly common practice of making sftp-only accounts
by making sftp-server the user's login shell.

It will be easier when Darren's "Match" stuff is done, because we
can
reuse it to do forced-commands in sshd_config.

-d