2

I'm running OpenSSH on Cygwin, which I'm trying to use as an SFTP server only. I installed it first with just the default settings (external SFTP server sftp-server) and it worked. I was able to run PuTTY's PSFTP and "open localhost" and browse my files.

However for security I wanted to:

  • Only allow SFTP access (not SSH)
  • Only allow me to login (not other users)
  • Only allow me to browse my own home directory
  • Only allow read-only access

To achieve this I put the following at the end of /etc/sshd_config:

Subsystem   sftp    internal-sftp

Match User myusername
        ChrootDirectory /home/myusername
        AllowTCPForwarding no
        X11Forwarding no
        ForceCommand internal-sftp -d / -R

Match User !myusername
        ForceCommand echo 'successful login man, congrats'

(The last part is from this answer, which essentially prevents the matching user from logging in.)

Note that I also added -d / to the internal-sftp command-line, as it told me it defaults to the home directory, so I thought it might try to load /home/myusername by default, which would map to /home/myusername/home/myusername on the real system (a path that does not exist).

However when trying to login, I now get the following error:

psftp> open localhost
login as: myusername
myusername@localhost's password:
Fatal: unable to initialise SFTP: could not connect
psftp>

Interestingly though, I am on the server, just not actually on the SFTP:

psftp> open localhost
login as: myusername
myusername@localhost's password:
Fatal: unable to initialise SFTP: could not connect
psftp> open localhost
psftp: already connected
psftp> pwd
Remote directory is (null)
psftp>

What am I doing wrong, or how can I get logs for further troubleshooting?

Kidburla
  • 131
  • 2
  • 8

1 Answers1

1

From sshd manual:

ChrootDirectory
Specifies the pathname of a directory to chroot(2) to after 
authentication. All components of the pathname must be root-owned 
directories that are not writable by any other user or group. After the 
chroot, sshd(8) changes the working directory to the user's home directory.

Most likely your home directory is not owned by root and sshd is refusing to chroot to a non-root owned directory, as it's unsafe. Create /home/chroot, chown it to root and move your home directory under that.

To easily debug these problems and avoid locking yourself out, I recommend running a separate instance of sshd on a different port, in no-detach mode and with debug enabled:

 /usr/sbin/sshd -D -d -p 2222
Luca Gibelli
  • 2,611
  • 1
  • 21
  • 29