There is seemingly a trick for creating read-only sshfs logins with the read only attribute is enforced by the remote's ~/.ssh/authorized_keys
file.
You first create a program ~/.ssh/ro-sftp-server
that runs sftp-server -R
, which whatever other options were passed. You next set up your restricted ssh key as usual in the remote's ~/.ssh/authorized_keys
file except adding a command restriction :
no-X11-forwarding,no-agent-forwarding,no-pty,command= “~/.ssh/ro-sftp-server” ssh-rsa ...
Finally, you mount the directory by invoking sshfs
.
sshfs -o ssh_command="ssh -i ~/.ssh/ro_key" \
-o sftp_server="~/.ssh/ro-sftp-server" \
-o idmap=mrmeow -o ro \
mrmeow@example.com:. ~/www/
Great! Now how do I permit writes but only after asking for a password?
I could certainly make autofs
mount a second read-write sshfs
volume on demand using a password protected but unrestricted key.
I'd finally need unionfs, mhddfs, or similar to make this second directory appear over the first, except apparently I'd need them both honestly mounted. :(
Any ideas about how one should achieve this "password prompt on write"? functionality?