Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
To: cygwin AT cygwin DOT com
From: john m lauck <john AT recaffeinated DOT com>
Subject: Re: Chrooted OpenSSH for Windows (rssh sftp cygwin)
Date: Tue, 30 Nov 2004 22:42:21 -0500
Lines: 65
Message-ID: <cojeiu$l2u$1@sea.gmane.org>
References: <BDCD3861.3BCF%john AT recaffeinated DOT com> <loom DOT 20041130T143350-849 AT post DOT gmane DOT org>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Complaints-To: usenet AT sea DOT gmane DOT org
X-Gmane-NNTP-Posting-Host: nr27-66-42-232-5.fuse.net
User-Agent: Mozilla Thunderbird 0.9 (Macintosh/20041103)
In-Reply-To: <loom.20041130T143350-849@post.gmane.org>
X-IsSubscribed: yes

Thanks, Christian!

I actually got the chrooted sftp session to *work* (! shell commands 
still work).  I made these changes:

--

chroot /cygdrive/c/StudentsShare /usr/sbin/sftp-server

-- 

Basically, I removed the 'exec' from the chroot call.  I thought maybe 
there were insufficient dll's in the chroot C:\StudentsShare.  I copied 
all the local files from the /usr, /bin and /etc folders to my chroot 
and still had the same problem with including the 'exec'.  Does anyone 
know how the exec effects chroot call?  I don’t understand how the exec 
makes it more secure by replacing the current script process.
However, this doesn't stop a user from entering a ! command at the sftp 
prompt.  I had some luck setting file privileges/ownership but that 
seems like a dangerous move to chmod/chown all the files outside of 
C:\StudentsShare.

Any ideas are welcome.

Also (in response to Christian Weinberger), I only need SFTP protocol 2.
I prefer to stick to SFTP just because it's easier to transfer a group 
of files and manipulate folders etc.

With time permitting for my project I may give scponly a try.


Christian Weinberger wrote:
> John M. L. <john <at> recaffeinated.com> writes:
> 
>>I've been trying to implement an sftp server using OpenSSH for Windows
>>(http://sshwindows.sourceforge.net).  I haven't found much recent discussion
>>on th topic of running OpenSSH in a chrooted jail on cygwin, but the
>>following messages from a year ago have shed some light on the topic:
> 
> 
> I solved exactly the same problem using scponly 
> (http://www.sublimation.org/scponly/)
> .
> The current version compiles easily under recent Cygwin releases.
> You only have to modify the Makefile to include some libraries explicitly.
> 
> I´d always try to have a binary as a chroot stub and not a shell script. If you 
> use a shell script, you need bash and several supplemental programs in the 
> chroot jail which all may contain security leaks.
> 
> The tool that I used has a make option to prepare the chroot jail. It copies 
> all required files to the jail. So you may learn from it even if you decide to 
> stay with rssh.
> 
> You´ve to make another decision:
> Do you only need to support sftp protocol version 2 or also older versions.
> In the first case it should be sufficient to have sftp-server.exe in the chroot 
> jail (plus a passwd & group). In the second case, you´ll need to have things 
> like bash, ls, rm and others again.
> 
> Hope this helps a bit!
> Christian
> 
> 



--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/