Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been researching this for a while but cant find and conclusive answeres. FTP - Very insecure. FTP over SSl - Not fully supported everywhere, only a few clients support it? SFTP - This is the one I have been trying as it's the most secure?

From talking to redhat, RHEL 5 (sshd) dosent support chroot jails for individual users, so the users can view system files etc...this must be a security risk. They can also view other users files.

Are there anyother options, people must have this situation all the time, are there any best practice options?

Thanks for any help / information!

share|improve this question

6 Answers 6

up vote 2 down vote accepted

SFTP/SCP is definitely the most secure of the options you've listed and is a fairly standard for traditional FTP access to a system.

RedHat are right, the version of sshd in RHEL5 is too old to support the ChrootDirectory option which makes sshd automatically setup a chroot for SCPing users. That said, it's not necessarily a massive security risk to allow users to view the file system - an unprivileged user will struggle to cause significant damage to a properly setup system - the main risk would be local privilege escalation as scp access requires a working shell.

Security at every level is the preferred option though, so there are some workarounds:

scponly ( http://sublimation.org/scponly | RPMs: http://packages.sw.be/scponly/ ) replaces the users shell so they can only read/write files and not execute them.

There are also other guides and scripts that will homebrew a chroot'd scp session for you (note, I haven't tested this particular script, it just came up top in a google search): http://www.fuschlberger.net/programs/ssh-scp-sftp-chroot-jail/

share|improve this answer
    
The SSHD in Centos5 is more than capable of doing Chroot.. I would assume it would be the same in RHEL5.. –  Arenstar Nov 12 '10 at 14:06

I would recommend you to use sftp/scp for your data-transfer.

You seem to be a little bit mis-informed about chroots. If you only need to provide data transfer possibilities for the users, the internal sftp support in OpenSSH does indeed support chrooting users.

Let's say you have a user group called leechers you want to give access to scp and their home directory, but nowhere else. In that case you would append this to /etc/ssh/sshd_config:

Match group leechers
         ChrootDirectory /home/%u
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp

Your other options include providing users a restricted shell, like lshell or rssh.

chrooting / jails is also a possibility, but most of the time more hassle than its worth.

share|improve this answer

sshd supports chroots like you want them since 4.3p2

You can use the following configuration (or something like this)

Subsystem       sftp    internal-sftp

Match User pacey
           ChrootDirectory /home/pacey
           ForceCommand internal-sftp
           AllowTCPForwarding no

You can also match groups using the Match Group directive.

share|improve this answer
    
RHEL 5, give an error on this. I assume it's version of sshd is to old? –  DaveB Nov 12 '10 at 10:34
    
I think openssh 4.4 came out in 2006 so I assume (since RHEL 5 was released in 2007) it might be included. Which version of sshd are you using? –  pacey Nov 12 '10 at 10:43
    
At the top of my sshd_conf is v1.73 2005/12/06. So I assume this version cant chroot? –  DaveB Nov 12 '10 at 11:03

From a system? HTTPS is well-understood, supported by lots of things, can chroot (in the sense of it being difficult to persuade the web browser to look outside DocumentRoot). Any good?

share|improve this answer

You can use rssh. It is very simple to use. Just allow scp/sftp/rsync in rssh.conf file and change users shell to /usr/sbin/rssh (or wherever rssh gets installed in RHEL).

share|improve this answer

WebDAV over HTTPS can be a good option (for transferring files to and from a server). WebDAV clients are available out of the box on a number of OS ("web folders" on Windows, or network drives, etc...). There are also separate clients if needed.

It may be a bit tricky if the file space on the server has to be visible by the users within their respective home directories, but you can otherwise manage it with the normal web server permissions usually.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.