Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a webserver where users are allowed to upload (SFTP) large files in a chroot environment. We also want to be able to use SSH to manage this server.

In our old situation we used the system sshd and a chroot environment with a seperate sshd running inside. I hoped I could simplify the configuration with the 'new' ChrootDirectory option.

Our server has two IP addresses, one for public access and one for internal access. Is it possible for a single sshd to listen to two seperate IPs/interfaces but treat them differently? In all the documentation I have read it seems like it is only possible to distinguish between users or groups, but not IPs/interfaces.

If this is not possible, is the dual sshd setup the best option, should I do beter User Management to filter them by Group or is there a more elegant way to setup a server like this?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

You could use Match in a reverse way. Chroot by default and then negate the directive if connecting from the internal network.

ChrootDirectory /chroot/somedir
Match Address 10.0.0.0/24
    ChrootDirectory none

However you should consider the implications of placing security decisions upon the networks. Including the possibility of an authenticated user creating a new session over loopback, to bypass such policies. Generally it would be safer to define User and Group if possible.

(edit: typed before reading properly)

share|improve this answer

The solution that I used in the end is the following:

Subsystem sftp internal-sftp
ChrootDirectory <my chroot directory>
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

Match User <my admin account> Address <my ip>
  ChrootDirectory none
  X11Forwarding yes
  AllowTcpForwarding yes
  ForceCommand /bin/bash

Match User <my admin account>
  ForceCommand none

So it is a mix of the answers I saw before, and I made two Match blocks, so that people from other IPs, but trying to use my admin account won't be able to use sftp or ssh. I will be monitoring the activity on the server closely to see if this works out, but internal tests look promising.

share|improve this answer

I created a group called sftpuplod. Every customer without ssh-access is in this group an just can use sftp:

# sshd_config:
Subsystem sftp internal-sftp
Match group sftpupload
    ChrootDirectory /home
    X11Forwarding no
    AllowTcpForwarding no
    ForceCommand internal-sftp

You also can use ChrootDirectory %h for real chrooting in ~

see the manual page

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.