There is a server running sshd to force all its connecting users into using chrooted SFTP. Everything is working fine so far.
I would like to have user root being able to log in using pubkey authentication, but whenever I try to "exclude" user root from being forced into SFTP every other is excluded as well.
Port 22 Protocol 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key UsePrivilegeSeparation yes KeyRegenerationInterval 3600 ServerKeyBits 1024 SyslogFacility AUTH LogLevel INFO LoginGraceTime 120 PermitRootLogin without-password StrictModes yes RSAAuthentication yes PubkeyAuthentication yes IgnoreRhosts yes RhostsRSAAuthentication no HostbasedAuthentication no PermitEmptyPasswords no ChallengeResponseAuthentication no X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes AcceptEnv LANG LC_* Subsystem sftp internal-sftp UsePAM yes #Match User !root ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no
This configuration is working as expected, but as soon as I enable the Match-rule near end of file everyone is able to log into regular shell via SSH.
... Match User !root ChrootDirectory %h ForceCommand internal-sftp AllowTcpForwarding no
Forcing into chrooted SFTP works for all users or for no one. Either I'm misunderstanding what
Match is good for - and all three listed rules are part of subset supported in context of
Match as well - or it's just failing to handle negated criteria. I even tried to replace
root with name of non-root user to no avail: every other user is capable of logging in as soon as the rule is enabled. What is it?
FWIW, I was observing sort of "confusing" log output as well when logging in as non-root user:
Nov 12 22:39:06 host sshd: Accepted password for nonroot from 188.8.131.52 port 54988 ssh2 Nov 12 22:39:06 host sshd: pam_unix(sshd:session): session opened for user nonroot by (uid=0)
The confusion is due to using privilege separation and having uid=0 opening a session for nonroot user. However, I assume this is basically intended behaviour for uid=0 is required to create processes on behalf of other users. But is this somehow messing with the test of being root or not!?