As a follow up to this stackoverflow question, I am trying to use sandbox-exec as an alternative to chrooted sftp with the internal-sftp method.
The sshd config is:
Subsystem sftp /usr/libexec/sftp-server Match User u1 X11Forwarding no AllowTcpForwarding no ForceCommand cd /vhosts/web/d1.com; sandbox-exec -f /vhosts/d1.sb /usr/libexec/sftp-server
The sandbox-exec config (/vhosts/d1.sb) file contains:
(version 1) (deny default) (import "system.sb") (allow process-exec (literal "/usr/libexec/sftp-server")) ;allow user to read/write anything under d1.com (allow file* (regex #"^/vhosts/web/d1.com")) ;needed to avoid 'can't canonilize error' (allow file-read-metadata (literal "/")) (allow file-read-metadata (literal "/vhosts")) (allow file-read-metadata (literal "/vhosts/web")) ;content from bsd.sb ; ...
As a result of this config, the user can only read/write in the directory /vhosts/web/d1.com but he can also guess what files exists anywhere in the filesystem by using error messages.
I have two questions:
A/ Can I hide error messages:
sftp> ls ../xkcd Couldn't stat remote file: **No such file or directory** Can't ls: "/vhosts/web/d1.com/../xkcd" not found sftp> ls ../d2.com Couldn't stat remote file: **Permission denied** Can't ls: "/vhosts/web/d1.com/../d2.com" not found
B/ When the user tries to ssh instead of sftp. I would like to have the same behavior as classical internal-sftp config: an error message and an immediate deconnection. Instead I have a blinking cursor with no invite (like if you launch sftp-server from command line). I am afraid that the user could use some sort of escape sequence that I am not aware of to escape from this state.