OpenWrt/LEDE setup for SFTP

Question

I want to use my router (A TP-Link WDR3600) running LEDE 17.01.4 as an SFTP server to store my backups created with borg. I already know how to perform backups and set up a USB drive, what I don't know is how to proper setup the SFTP server part for security and maintainability, like:

• Do I have to create a dedicated user?
• If so, how to restrict permissions to that backup user, so that it can't peek into sensitive files in the filesystem?

I am basically looking for the best practices to run a sane SFTP server, but using the limited environment of an embedded system. If possible, I'd prefer not to use openssh since it's not integrated within the UCI system.

My question might be too wide, please let me know if that's the case.

Answer 1

Do I have to create a dedicated user?

Yep. Create a non-privileged user named borg. Below is exceprt from OpenWrt documentation:

Then do this since you want to use the included dropbear and not openssh-server:

The way it works: any account that can SSH can use SFTP, and once you create the account on the local system, and optionally setup keys, you can SFTP immediately.

If so, how to restrict permissions to that backup user, so that it can't peek into sensitive files in the filesystem?

Non-root users won't be able to do much outside of their home directories, that isn't set with open permissions.

To prevent other non-root users from modifying borg-owned files, use borg's umask option with a value of 027 - this will make any new files inaccessible to anyone but root or borg.