Secure data transfer from a RHEL 5 box

Question

I have been researching this for a while but cant find and conclusive answeres. FTP - Very insecure. FTP over SSl - Not fully supported everywhere, only a few clients support it? SFTP - This is the one I have been trying as it's the most secure?

From talking to redhat, RHEL 5 (sshd) dosent support chroot jails for individual users, so the users can view system files etc...this must be a security risk. They can also view other users files.

Are there anyother options, people must have this situation all the time, are there any best practice options?

Thanks for any help / information!

Answer 1

SFTP/SCP is definitely the most secure of the options you've listed and is a fairly standard for traditional FTP access to a system.

RedHat are right, the version of sshd in RHEL5 is too old to support the ChrootDirectory option which makes sshd automatically setup a chroot for SCPing users. That said, it's not necessarily a massive security risk to allow users to view the file system - an unprivileged user will struggle to cause significant damage to a properly setup system - the main risk would be local privilege escalation as scp access requires a working shell.

Security at every level is the preferred option though, so there are some workarounds:

scponly ( http://sublimation.org/scponly | RPMs: http://packages.sw.be/scponly/ ) replaces the users shell so they can only read/write files and not execute them.

There are also other guides and scripts that will homebrew a chroot'd scp session for you (note, I haven't tested this particular script, it just came up top in a google search): http://www.fuschlberger.net/programs/ssh-scp-sftp-chroot-jail/

Answer 2

I would recommend you to use sftp/scp for your data-transfer.

You seem to be a little bit mis-informed about chroots. If you only need to provide data transfer possibilities for the users, the internal sftp support in OpenSSH does indeed support chrooting users.

Let's say you have a user group called leechers you want to give access to scp and their home directory, but nowhere else. In that case you would append this to /etc/ssh/sshd_config:

Match group leechers
         ChrootDirectory /home/%u
         X11Forwarding no
         AllowTcpForwarding no
         ForceCommand internal-sftp

Your other options include providing users a restricted shell, like lshell or rssh.

chrooting / jails is also a possibility, but most of the time more hassle than its worth.

Answer 3

sshd supports chroots like you want them since 4.3p2

You can use the following configuration (or something like this)

Subsystem       sftp    internal-sftp

Match User pacey
           ChrootDirectory /home/pacey
           ForceCommand internal-sftp
           AllowTCPForwarding no

You can also match groups using the Match Group directive.

Answer 4

From a system? HTTPS is well-understood, supported by lots of things, can chroot (in the sense of it being difficult to persuade the web browser to look outside DocumentRoot). Any good?

Answer 5

You can use rssh. It is very simple to use. Just allow scp/sftp/rsync in rssh.conf file and change users shell to /usr/sbin/rssh (or wherever rssh gets installed in RHEL).

Answer 6

WebDAV over HTTPS can be a good option (for transferring files to and from a server). WebDAV clients are available out of the box on a number of OS ("web folders" on Windows, or network drives, etc...). There are also separate clients if needed.

It may be a bit tricky if the file space on the server has to be visible by the users within their respective home directories, but you can otherwise manage it with the normal web server permissions usually.