Howto log multiple sftpd instances with their chroot shared via NFS

[Douglas E Engert]

On 9/26/2021 3:20 PM, Peter Stuge wrote:
> Jochen Bern wrote:
>> OK. This is a behavior I see (and use) on a CentOS SFTP server, but I
>> have no idea how portable it is to other distribs, so just give it a try:
>>
>>> # egrep '^[^#]*( mand|sftp)' /etc/ssh/sshd_config
>>> Subsystem       sftp    internal-sftp
>>> Match group mandanten
>>>          ForceCommand internal-sftp -l INFO -u 0077
>>
>>
>>> # ls -al ~lvinq4/dev
>>> insgesamt 0
>>> drwx--x---. 2 root mandanten  6 20. Mai 17:25 .
>>> drwxr-x---. 5 root mandanten 54 24. Aug 15:38 ..
>>
>> As you can see, the chroots have an *empty* /dev subdir, but logging
>> *still works*, apparently because the chrooted process just keeps using
>> the system-central /dev/log it opened *before* chroot()ing.
> 
> I think that works specifically because *no* new process is created
> when using internal-sftp as opposed to executing the sftp-server binary.
> 

It is not clear from Hildegard's email what is in the user's home directory
and if the sftp server can run in interactive mode. i.e. if a shell is started,
and if it can run any commands that may require logging.

OpenSSH sshd_config man page discusses ChrootDirectory says: "For an interactive session this requires at least a shell"
and also says: "sessions which use logging may require /dev/log inside the chroot directory on some operating systems."

So I would say the /dev/log or logs are required.

Based on the problem in original note:

> So, if a user logs in on the first server, where syslog-ng was started least, the user's sftp activity is logged on the first server.
> But if the user logs in on the second server, it's sftp activity is not logged, neither on the second nor on the first server.
> 
> If the syslog-ng is then restarted on the second server, the sftp user's activity is exclusively logged only on the second server and only for logins on the second server.

Logging works on the server that started syslog-ng. It sounds like syslog-ng opens a "unix-stream" socket.
She also says: "for every user has a log device /var/data/chroot/<username>/dev/log"
(not sure what it changes, it may save the socket handle/index (or whatever it is) to be used in that server's kernel.)

Each server is overwriting the /dev/log in the chroot directories.

So if interactive is not required, then no chroot /dev/log would be needed and sftp-initeral could work.
But it sounds like there is a need to share these NFS volumes

So we are back to using bind-mounting as it is done in the kernel and NFS version of /dev/log is not touched.

OR

Each server has its own /dev/log_<hostname> and the syslog-ng files on each server do the same
and use LD_PRELOAD= as proposed by Peter Stuge. I have used the LD_PRELOAD before when running
valgrind and/or gdb to not unload modules so as the debug tables stay available,


> If syslog-ng can be made to reliably route internal-sftp messages to
> user-specific log files then this approach would work well in Hildegard's
> setup and would be a lot more pleasant than messing with LD_PRELOAD. 

As noted above, depends if any other process is stared that does logging is started after the
change to chroot.

> 
> 
> //Peter
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
> 

-- 

  Douglas E. Engert  <DEEngert at gmail.com>