Message-ID: <4934527E.2070200@cygwin.com>
Date: Mon, 01 Dec 2008 16:09:18 -0500
From: "Larry Hall (Cygwin)" <reply-to-list-only-lh AT cygwin DOT com>
Reply-To: cygwin AT cygwin DOT com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.18) Gecko/20081120 Remi/2.0.0.18-1.fc8.remi Lightning/0.9 Thunderbird/2.0.0.18 Mnenhy/0.7.5.0
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: Finally managed to create a jailed SFTP server, but how secure?
References: <664060 DOT 6380 DOT qm AT web34704 DOT mail DOT mud DOT yahoo DOT com> <49341625 DOT 2090804 AT cygwin DOT com> <933558 DOT 98400 DOT qm AT web34705 DOT mail DOT mud DOT yahoo DOT com>
In-Reply-To: <933558.98400.qm@web34705.mail.mud.yahoo.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com

On 12/01/2008, TheO wrote:
> According to my observation, regardless of his authentication (public key 
> or password), he can only see a limited number of directories within the 
> jail environment. The only directory which is virtually added by Cygwin 
> during his login, and therefore beyond my control, is /cygdrive. Luckily 
> enough for me, it is empty so in my opinion the user can't traverse my 
> harddisk.

If you're happy with the results, that's fine.  However, you asked how
secure SFTP was.  The answer is as I've said.  Cygwin is not the O/S.
It cannot enforce restrictions on the O/S.  Only the O/S can restrict
or grant access to users.

I have not attempted to set up a jailed SFTP environment on Cygwin.  It
may be that what you've done hems the user into the area you want when
he/she is using Cygwin tools.  However, this does not restrict the user
with Windows native tools.  If he/she is able to leverage those inside
the jail, then the user has the keys he/she wants to get out.

-- 
Larry Hall                              http://www.rfk.com
RFK Partners, Inc.                      (508) 893-9779 - RFK Office
216 Dalton Rd.                          (508) 893-9889 - FAX
Holliston, MA 01746

_____________________________________________________________________

A: Yes.
 > Q: Are you sure?
 >> A: Because it reverses the logical flow of conversation.
 >>> Q: Why is top posting annoying in email?

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/