Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

roots. I'm running an Ubuntu 9.04 (home) Server on my LAN. I currently use it to store little web apps, photos, some subversion repository and stuff like that. My (few) users are friends of mine and I always provided them with a jailed FTP access to their home directory. Now, recently I realised that FTP is not so secure since passwords are not masked when the connection is established and thus are easily sniffable.

I decided to solve this problem using SFTP but there is an issue that keeps me wondering and I need your opinion about it.

Using SFTP the access to the filesystem depends on the SSH settings. So to jail users to their home directory for SFTP I have to jail them too when they use SSH, my question is: is this a desirable configuration? It is not a limitation on an UNIX user common-sense privileges?

There is a secondary issue that is: is there a straightforward way to accomplish that under Ubuntu 9.04 Server?

Thank you Tommaso

share|improve this question

4 Answers 4

up vote 7 down vote accepted

chrooting users using ssh is not a desirable configuration in most cases. When they're jailed into their home dir, they won't be able to use any programs outside their home dir. This makes unix almost unusable as a shell server.

You can use FTPS instead of SFTP/SCP, which will send passwords over SSL, but uses an ssh server, allowing you to chroot them for file transfer, but not for login (although little is gained if you only chroot their file transfers, and they will still be able to scp data from the machine).

share|improve this answer
1  
I would up-vote, but my reputation doesn't allow that yet. :) Thank you for the answer. –  tunnuz Jul 15 '09 at 19:16
    
can you mark my answer as accepted instead :-) –  Cian Jul 15 '09 at 19:24
1  
+1 for a good answer. Since you pretty much said what I was going to say... MY answer was going to recommend probation instead of jail depending on whether or not his state has a "three strikes" law. ;-) –  KPWINC Jul 15 '09 at 20:46

If they already have unjailed ssh access then there would be nothing to gain by restricting sftp even if you could do it.

Sure, there was a good reason to chroot the ftp server, but If I already have ssh access to the full machine there's no added security risk to me having sftp access.

share|improve this answer

You should force users to use sftp with rssh (restricted shell). This combined with other normal security steps (key based authentication) and you will be fairly secure.

share|improve this answer
    
That would make it impossible for the users to use ssh, which was the point of the question. –  theotherreceive Jul 15 '09 at 19:23
    
If you create SFTP-only accounts, then set them up with rssh as their shell, that sounds like a good way to do it. –  Ernie Jul 15 '09 at 21:12

I use MySecureShell to limit SFTP connections on a per user account basis for our Linux boxes.

http://mysecureshell.sourceforge.net/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.