1

I'm not able working on SFTP+chrooted env Using internal-sftp directive it works, but i'm not able to set umask. (ex umask 002) Using sftp-server from openssh package dosent't work because login shell for chrooted only user replay with /bin/false (file not found) This is a sshd server behaviour from: http://www.openssh.org/faq.html#2.9

My sshd config:

Match User sftponly
ChrootDirectory /mnt/www-prod-shared-jail/sftponly/
AllowTCPForwarding no
X11Forwarding no
#ForceCommand internal-sftp -u 002
ForceCommand /usr/lib/openssh/sftp-server
#ForceCommand /bin/sh -c 'umask 002; /usr/lib/openssh/sftp-server'

how do you solved this ? My chrooted environment , in home (chrooted) is /jail/user/bin/false

I try:

  • delete .bashrc
  • disabled /bin/bash in /etc/passwd setting /bin/false
  • try to recreate /bin/bash in choroot but nothing works.

Do you have any ideas ?

Thanks, Ema

3 Answers 3

1

The internal sftp server is running as root and therefore picks up roots umask. you can fix this by forcing the umask e.g. in /etc/ssh/sshd_config change

Subsystem sftp /usr/lib/openssh/sftp-server

to

Subsystem sftp /bin/sh -c 'umask 0002; /usr/libexec/openssh/sftp-server'

or whatever umask you want.

4
  • I've tried this but it dosen't work. I think sshd replay to login with some error, like "bin/bahs not found" and login fails
    – emaaaa
    Apr 9, 2011 at 8:07
  • emaaaa-s-mbp:~ emaaaa$ ssh myuser@myserver /usr/bin/true myuser@myserver's password: /bin/false: No such file or directory
    – emaaaa
    Apr 9, 2011 at 9:15
  • Try again with ' as a quote and not `
    – user9517
    Apr 9, 2011 at 9:52
  • ssh myuser@myserver /usr/bin/true myuser@myserver's password: /bin/false: No such file or directory @lain
    – emaaaa
    Apr 9, 2011 at 10:11
0

I ran into this recently. Specifying the umask in sshd_config works with sftp, but not with internal-sftp. Unfortunately, in order to jail the users without creating an entire chroot environment, you have to use internal-sftp. The good news is that there is still a way to set the umask if you're using PAM.

Create a group that contains all of your sftp users. For the example, let's call it sftpjail.

Then add the following to /etc/pam.d/login

session optional pam_umask.so sftpjail umask=0002

This will set the umask for all the users in the sftpjail group.

EDIT If you want to use the config that you have above, I'm pretty sure what you're missing is the chroot environment (binaries, config files, etc.) - hence the "file not found" errors when it tries to chroot. Though if it were me, I'd go back to using "ForceCommand internal-sftp" and set the umask in PAM

4
  • Hi @Bill B I try this config on my server but It dosent' works.
    – emaaaa
    Apr 10, 2011 at 20:43
  • @emaaaa It's working for me on several systems. My best guess is that you still have something misconfigured.
    – Bill B
    Apr 12, 2011 at 14:10
  • I am currently using ForceCommand internal-sftp. So how do I set the umask in PAM? Is that the method you posted? If so, I couldn't get it to work.
    – Strawberry
    Aug 10, 2011 at 0:33
  • @Doug - Yes, adding the above line to /etc/pam.d/login should enforce the umask of 0002 for all members of group sftpjail. Of course, your group name will be different.
    – Bill B
    Aug 10, 2011 at 2:37
0

I had that problem, but I was using ssh on the client machine instead of sftp. As soon as I used sftp user@host instead of ssh user@host, it worked fine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .