Napp-it unable to isolate sftp user to zfs pool hosted directory.

[nonyhaha]

Hello!

I am trying to send some video files over the internet to my napp-it hosted zfs pool.
The pool is working ok locally.

I created a user with no console access, and set the following in /etc/ssh/sshd_config:
Subsystem sftp /usr/libexec/amd64/sftp-server
Match User sftpuser #same as the user i created
ForceCommand internal-sftp
#Chrootdirectory /secunda/blacksea/Camere_Comarnic/ #the folder i want to isolate the user to
ChrootDirectory /jail/ #the folder where if i isolate the user, it is working.
AllowTcpForwarding no
X11Forwarding no

when using folder "/jail/" I can login through sftp using winscp locally.
when using folder "/secunda/blacksea/Camere_Comarnic/" and I try to login, I get an "Authentication failed" error in winscp.

I think it might have something to do with permissions, atm:
drwxr-xr-x 3 root root 3 Nov 6 15:49 jail

drwxr-xr-x+ 4 root root 4 Apr 5 2023 secunda

drwxrwxrwx+ 32 root root 33 Nov 6 20:30 blacksea

drwxr-xr-x+ 4 root root 4 Nov 7 09:56 Camere_Comarnic

Can anybody helm me solve this issue?

 

[nonyhaha]

NOPE.
After some time it simply stopped working, without any modifications.
I can't even access it locally with the isolated user. I can sftp using root.
current config:
/etc/ssh/sshd_config:
Subsystem sftp /usr/libexec/amd64/sftp-server
Match User nonisftp
ForceCommand internal-sftp
Chrootdirectory /secunda/CamereComarnic/
AllowTcpForwarding no
X11Forwarding no

ls -al /
drwxr-xr-x+ 5 root root 5 Nov 7 11:19 secunda
ls -al /secunda/
drwxr-xr-x+ 4 root root 4 Nov 7 12:35 CamereComarnic
ls -al /secunda/CamereComarnic/
drwxrwxrwx+ 2 nonisftp sftp 2 Nov 7 11:22 Camere

L.E.
To secure somewhat what I am doing, i disable the permitrootlogin in sshd_config.
But I needed to do some usermod on some directiories, so I reenabled it through napp-it GUI.
This modified also the line "AllowUsers root" in sshd_config, which disabled other users access.

 

[gea]

You probably would need to edit ssh settings manually but I would use another method:

- use DynDNS and VPN for Client-LAN connectivity over Internet, easiest and fastest is Wireguard.
Most propably your Internet router has Wireguard build in, if not use a cheap Glinet travel router as Wireguard server with port forwarding of Wireguard.

- Install Wireguard on a remote client to connect client with your home lan/wlan

Your remote client behaves then exactly as it would when connected directly to home lan/wlan. You can also use the VPN tunnel to be protected in unsecure open hotel wlans. This means that you can now simply use SMB ex in Windows \\ip\share with local SMB users and ACL permissions.

 

[nonyhaha]

Hi @gea and thank you for replying, as usual.
I have thought of that, I am running a pfsense also an I already have vpn servers running in both locations, but I wouldn't like to vpn the entire home assistant vm, or even worse, all traffic. I thought that easiest method that is pretty safe would be sftp.
But Home assistant OS is not allowing me to mount an sftp location, so at the moment I am still looking for methods to sync LIVE some folders (video recordings of surveillance cameras) that are being updated on each event.
Rsync is out of the question at this moment as it needs to be triggered/run for it to do the sync.

 

[gea]

I would never expose a whole server to the Internet, not even with sftp without a firewall gateway that blocks all other ports. VPN (client-lan, client-server or lan-lan) is the safest option.

 

[nonyhaha]

No server is exposed entirely. The main server with the napp-it vm is behind a reverse proxy hosted by pfsense.

 

[gea]

Remains the problem that ssh is a management tool for an admin or privileged host not a general use multiuser filesharing tool like NFS or SMB. There are not so many options to configure ssh in /etc/ssh/sshd_config. You would need a full featured (s)ftp server with user management that is not part of a default OmniOS setup.

For a single user, maybe this is helpful

Configure a SFTP server with OpenSSH on OmniOS - UnitedBSD

This site's focus is BSD [ DragonFlyBSD , FreeBSD , NetBSD , OpenBSD ,OtherBSDs and Unix ] Operating Systems

www.unitedbsd.com