using OpenSSH/SFTP to replace an FTP server securely

[Damien Miller]

On Mon, 19 May 2014, IMAP List Administration wrote:

> Hello Folks,
> 
> I'm trying to replace an FTP with several hundred users with something secure.
> 
> My requirements:
>     - transfers must be logged
>     - users should not have any access to other users' directories
>     - users should land in a writable directory
>     - users should be chrooted
> 
> I've been trying to get this working with OpenSSH and the internal SFTP server,
> but it does not seem possible....
> 
> If I chroot each user using "ChrootDirectory /home/%u", there are two problems:
>     1) the user lands in a directory to which he cannot write
>     2) I would need hundreds of syslog logging sockets, one in each user's
> chrooted environment

The first problem is easily solved. You can specify a different starting
directory on the sftp-server commandline using the '-d' option.

E.g.

Subsystem sftp internal-sftp -d sftp

(and create 'sftp' directory under /home/$user)

The syslog problem doesn't have a good solution right now. Maybe someone
could write a patch to implement logging via the monitor, like what happens
for the pre-auth process.

-d