I've set up a chrooted sftp folder following the instructions here: http://www.thegeekstuff.com/2012/03/chroot-sftp-setup/
It works fine, my only problem is it appears there is a glaring vulnerability that could potentially allow information on the server to be compromised if the user uploading the content is hacked.
Specifically, sftp allow you to create symbolic links, so for example if the drop folder is compromised all they have to do is sftp in and then:
sftp> symlink /etc/passwd web/user-list
And assuming that the web
folder is is the web root for the website, then going to http://example.com/user-list
will show the contents of /etc/passwd.
This allows read access to any file on the system, anywhere, that the web server user could have read access to — all they have to do is create a symbolic link pointing to it.
So, they could use the following to get a hold of our certificates in order to spoof our server:
sftp> symlink /etc/httpd/certs/example.key private-key
sftp> symlink /etc/httpd/certs/example.crt public-cert
So I guess my question is: is there any way to block this?