using OpenSSH/SFTP to replace an FTP server securely
djm at mindrot.org
Tue May 20 17:30:55 EST 2014
On Mon, 19 May 2014, IMAP List Administration wrote:
> Hello Folks,
> I'm trying to replace an FTP with several hundred users with something secure.
> My requirements:
> - transfers must be logged
> - users should not have any access to other users' directories
> - users should land in a writable directory
> - users should be chrooted
> I've been trying to get this working with OpenSSH and the internal SFTP server,
> but it does not seem possible....
> If I chroot each user using "ChrootDirectory /home/%u", there are two problems:
> 1) the user lands in a directory to which he cannot write
> 2) I would need hundreds of syslog logging sockets, one in each user's
> chrooted environment
The first problem is easily solved. You can specify a different starting
directory on the sftp-server commandline using the '-d' option.
Subsystem sftp internal-sftp -d sftp
(and create 'sftp' directory under /home/$user)
The syslog problem doesn't have a good solution right now. Maybe someone
could write a patch to implement logging via the monitor, like what happens
for the pre-auth process.
More information about the openssh-unix-dev